CVE-2022-42476

Summary

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiOS7.2.0 <= 7.2.3affected
FortinetFortiOS7.0.0 <= 7.0.8affected
FortinetFortiOS6.4.0 <= 6.4.11affected
FortinetFortiOS6.2.0 <= 6.2.12affected
FortinetFortiProxy7.2.0 <= 7.2.1affected
FortinetFortiProxy7.0.0 <= 7.0.7affected
FortinetFortiProxy2.0.0 <= 2.0.11affected
FortinetFortiProxy1.2.0 <= 1.2.13affected
FortinetFortiProxy1.1.0 <= 1.1.6affected

Weaknesses

  • CWE-23: Escalation of privilege

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References