PT-2023-9682 · Fortinet · Fortianalyzer+1

Published 2023-04-11 · Updated 2023-04-18 · CVE-2022-42477

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.6 FortiAnalyzer version 6.4

Description The issue is related to improper input validation, which may allow an authenticated attacker to disclose file system information via custom SQL queries to a dataset. This can potentially reveal sensitive information about the file system.

Recommendations For FortiManager and FortiAnalyzer versions prior to 7.2.1, update to a version that includes the fix for this issue. For FortiAnalyzer versions prior to 7.0.6, update to a version that includes the fix for this issue. For FortiAnalyzer version 6.4, consider disabling custom dataset SQL queries until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-09672

CVE-2022-42477

Affected Products

Fortianalyzer

Fortimanager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-42477 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-432 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09672 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42477 · Vendor Advisory
• https://t.me/cibsecurity/61894 · Telegram Post