CVE-2022-22299

Published: Aug 5, 2022Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.

Affected (20)

Products: Fortinet: Fortiadc, Fortimail, Fortios, Fortiproxy

4 products

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiadc	From 6.0.0 to 6.0.4
Fortinet Fortiadc	From 6.1.0 to 6.1.6
Fortinet Fortiadc	Version 6.2.0
Fortinet Fortiadc	Version 6.2.1
Fortinet Fortimail	From 6.4.0 to 6.4.5
Fortinet Fortimail	From 7.0.0 to 7.0.2
Fortinet Fortios	From 5.0.0 to 5.0.14
Fortinet Fortios	From 5.2.0 to 5.2.15
Fortinet Fortios	From 5.4.0 to 5.4.13
Fortinet Fortios	From 5.6.0 to 5.6.14
Fortinet Fortios	From 6.0.0 to 6.0.14
Fortinet Fortios	From 6.2.0 to 6.2.10
Fortinet Fortios	From 6.4.0 to 6.4.8
Fortinet Fortios	From 7.0.0 to 7.0.2
Fortinet Fortiproxy	From 1.0.0 to 1.0.7
Fortinet Fortiproxy	From 1.1.0 to 1.1.6
Fortinet Fortiproxy	From 1.2.0 to 1.2.13
Fortinet Fortiproxy	From 2.0.0 to 2.0.7
Fortinet Fortiproxy	Version 7.0.0
Fortinet Fortiproxy	Version 7.0.1

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (2)

https://fortiguard.com/psirt/FG-IR-21-235

Source: psirt@fortinet.com

PatchVendor Advisory

https://fortiguard.com/psirt/FG-IR-21-235

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.