CVEvulnerability

CVE-2022-22300

8.8 HIGH Published 2022-03-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-755

Description

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.

Affected configurations

• fortinet fortianalyzer (>= 5.6.0 <= 5.6.11) • fortinet fortianalyzer (>= 6.0.0 <= 6.0.11) • fortinet fortianalyzer (>= 6.2.0 <= 6.2.9) • fortinet fortianalyzer (>= 6.4.0 <= 6.4.7) • fortinet fortianalyzer (>= 7.0.0 < 7.0.3) • fortinet fortimanager (>= 5.6.0 <= 5.6.11) • fortinet fortimanager (>= 6.0.0 <= 6.0.11) • fortinet fortimanager (>= 6.2.0 <= 6.2.9) • fortinet fortimanager (>= 6.4.0 <= 6.4.7) • fortinet fortimanager (>= 7.0.0 < 7.0.3)

Related

Weakness · CWE (1)

  • CWE-755 Improper Handling of Exceptional Conditions weakness

References