CVE-2022-39946 HIGH

CVE-2022-39946

Vendor Fortinet
Product FortiNAC
Weakness CWE-284
Published June 13, 2023
Last update October 22, 2024
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RL:X/RC:C

What the vulnerability does

01Description

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

Key dates

02Disclosure timeline

June 13, 2023 CVE published
October 22, 2024 Record updated