CVE-2022-22300

EUVD-2022-27446
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
fortinetCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
fortinetfortianalyzer
5.6.0 ≤
𝑥
≤ 5.6.11
fortinetfortianalyzer
6.0.0 ≤
𝑥
≤ 6.0.11
fortinetfortianalyzer
6.2.0 ≤
𝑥
≤ 6.2.9
fortinetfortianalyzer
6.4.0 ≤
𝑥
≤ 6.4.7
fortinetfortianalyzer
7.0.0 ≤
𝑥
< 7.0.3
fortinetfortimanager
5.6.0 ≤
𝑥
≤ 5.6.11
fortinetfortimanager
6.0.0 ≤
𝑥
≤ 6.0.11
fortinetfortimanager
6.2.0 ≤
𝑥
≤ 6.2.9
fortinetfortimanager
6.4.0 ≤
𝑥
≤ 6.4.7
fortinetfortimanager
7.0.0 ≤
𝑥
< 7.0.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://fortiguard.com/psirt/FG-IR-21-255
https://fortiguard.com/psirt/FG-IR-21-255