CVE-2022-27490
5.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
Summary
A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via diagnose debug commands.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Fortinet | FortiManager | 6.0.0 <= 6.0.4 | affected |
| Fortinet | FortiManager | 5.6.0 <= 5.6.11 | affected |
| Fortinet | FortiAnalyzer | 6.0.0 <= 6.0.4 | affected |
| Fortinet | FortiAnalyzer | 5.6.0 <= 5.6.11 | affected |
| Fortinet | FortiPortal | 6.0.0 <= 6.0.9 | affected |
| Fortinet | FortiPortal | 5.3.0 <= 5.3.8 | affected |
| Fortinet | FortiPortal | 5.2.0 <= 5.2.6 | affected |
| Fortinet | FortiPortal | 5.1.0 <= 5.1.2 | affected |
| Fortinet | FortiPortal | 5.0.0 <= 5.0.3 | affected |
| Fortinet | FortiPortal | 4.2.0 <= 4.2.2 | affected |
| Fortinet | FortiPortal | 4.1.0 <= 4.1.2 | affected |
| Fortinet | FortiSwitch | 7.0.0 <= 7.0.4 | affected |
| Fortinet | FortiSwitch | 6.4.0 <= 6.4.10 | affected |
| Fortinet | FortiSwitch | 6.2.0 <= 6.2.7 | affected |
| Fortinet | FortiSwitch | 6.0.0 <= 6.0.7 | affected |
Weaknesses
- CWE-200: Information disclosure
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.