CVE-2022-33876

Summary

Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiADC7.1.0affected
FortinetFortiADC7.0.0 <= 7.0.2affected
FortinetFortiADC6.2.0 <= 6.2.4affected
FortinetFortiADC6.1.0 <= 6.1.6affected
FortinetFortiADC6.0.0 <= 6.0.4affected
FortinetFortiADC5.4.0 <= 5.4.5affected
FortinetFortiADC5.3.0 <= 5.3.7affected
FortinetFortiADC5.2.0 <= 5.2.8affected
FortinetFortiADC5.1.0 <= 5.1.7affected

Weaknesses

  • CWE-20: Improper access control

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References