CVEvulnerability

CVE-2022-38377

2.7 LOW Published 2022-11-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284

Description

An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information.

Affected configurations

• fortinet fortianalyzer (>= 6.0.0 <= 6.0.12) • fortinet fortianalyzer (>= 6.2.0 <= 6.2.10) • fortinet fortianalyzer (>= 6.4.0 <= 6.4.8) • fortinet fortianalyzer (>= 7.0.0 <= 7.0.3) • fortinet fortianalyzer 7.2.0 • fortinet fortimanager (>= 6.0.0 <= 6.0.11) • fortinet fortimanager (>= 6.2.0 <= 6.2.9) • fortinet fortimanager (>= 6.4.0 <= 6.4.7) • fortinet fortimanager (>= 7.0.0 <= 7.0.3) • fortinet fortimanager 7.2.0

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References