Description:
Fortinet released security advisories to address multiple vulnerabilities in Fortinet products in addition to the remote authentication bypass vulnerability (CVE-2022-40684) mentioned in security alert (A22-10-05). An attacker could exploit these vulnerabilities by sending specially crafted requests to an affected system.
Affected Systems:
- FortiAnalyzer version prior to 7.0.4
- FortiManager version prior to 7.0.4
- FortiOS version prior to 6.0.15, 6.2.11, 6.4.10, 7.0.6 or 7.2.1
- FortiProxy version prior to 2.0.10 or 7.0.5
- FortiTester version prior to 3.9.2, 4.2.1 or 7.1.1
Impact:
Depending on the vulnerability exploited, a successful attack could lead to arbitrary command injection, denial of service, information disclosure, privilege escalation or security restriction bypass on an affected system.
Recommendation:
Software updates for affected systems are now available. Administrators of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
More Information:
- https://www.fortiguard.com/psirt/FG-IR-21-242
- https://www.fortiguard.com/psirt/FG-IR-22-026
- https://www.fortiguard.com/psirt/FG-IR-22-086
- https://www.fortiguard.com/psirt/FG-IR-22-237
- https://www.fortiguard.com/psirt/FG-IR-22-244
- https://www.fortiguard.com/psirt/FG-IR-22-247
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44171
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26121
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29055
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33873
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35844
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35846