PT-2023-7424 · Fortinet · Fortigate+1

Published 2023-04-11 · Updated 2023-04-18 · CVE-2022-42469

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiGate versions 7.2.3 and below FortiGate versions 7.0.9 and below

Description The issue is related to a permissive list of allowed inputs, which may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal. This is associated with shortcomings in the access control list (ACL) in FortiOS, the operating system of FortiGate firewalls. Exploitation of this issue could enable a remote attacker to bypass existing access restrictions.

Recommendations For FortiGate versions 7.2.3 and below, update to a version above 7.2.3 to resolve the issue. For FortiGate versions 7.0.9 and below, update to a version above 7.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the web portal or disabling the use of bookmarks for authenticated SSL-VPN users until a patch is available.

Fix

Weakness Enumeration

CWE-183

Related Identifiers

BDU:2023-08461

CVE-2022-42469

Affected Products

Fortigate

Fortios

References · 4

• https://fortiguard.com/psirt/FG-IR-22-381 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08461 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42469 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42469 · Vendor Advisory