CVE-2022-27488
Assigner: fortinet
Published: 2023-12-13T06:39:42.998Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiVoice
defaultStatus: unaffected
versions: versionType: semver
version: 6.4.0
lessThanOrEqual: 6.4.7
status: affected
versionType: semver
version: 6.0.0
lessThanOrEqual: 6.0.11
status: affected
vendor: Fortinet
product: FortiRecorder
defaultStatus: unaffected
versions: versionType: semver
version: 6.4.0
lessThanOrEqual: 6.4.2
status: affected
versionType: semver
version: 6.0.0
lessThanOrEqual: 6.0.11
status: affected
versionType: semver
version: 2.7.0
lessThanOrEqual: 2.7.7
status: affected
versionType: semver
version: 2.6.0
lessThanOrEqual: 2.6.3
status: affected
vendor: Fortinet
product: FortiSwitch
defaultStatus: unaffected
versions: versionType: semver
version: 7.0.0
lessThanOrEqual: 7.0.4
status: affected
versionType: semver
version: 6.4.0
lessThanOrEqual: 6.4.10
status: affected
versionType: semver
version: 6.2.0
lessThanOrEqual: 6.2.8
status: affected
versionType: semver
version: 6.0.0
lessThanOrEqual: 6.0.7
status: affected
vendor: Fortinet
product: FortiNDR
defaultStatus: unaffected
versions: version: 7.1.0
status: affected
versionType: semver
version: 7.0.0
lessThanOrEqual: 7.0.4
status: affected
versionType: semver
version: 1.5.0
lessThanOrEqual: 1.5.3
status: affected
version: 1.4.0
status: affected
versionType: semver
version: 1.3.0
lessThanOrEqual: 1.3.1
status: affected
version: 1.2.0
status: affected
version: 1.1.0
status: affected
vendor: Fortinet
product: FortiMail
defaultStatus: unaffected
versions: versionType: semver
version: 7.0.0
lessThanOrEqual: 7.0.3
status: affected
versionType: semver
version: 6.4.0
lessThanOrEqual: 6.4.6
status: affected
versionType: semver
version: 6.2.0
lessThanOrEqual: 6.2.9
status: affected
versionType: semver
version: 6.0.0
lessThanOrEqual: 6.0.12
status: affected
descriptions: value: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.
problemTypes: descriptions: cweId: CWE-352
description: Execute unauthorized code or commands
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:C
solutions: value: Please upgrade to FortiVoice version 7.0.0 or above 
Please upgrade to FortiVoice version 6.4.8 or above 
Please upgrade to FortiVoice version 6.0.12 or above 
Please upgrade to FortiRecorder version 7.0.0 or above 
Please upgrade to FortiRecorder version 6.4.3 or above 
Please upgrade to FortiRecorder version 6.0.12 or above 
Please upgrade to FortiSwitch version 7.2.0 or above 
Please upgrade to FortiSwitch version 7.0.5 or above 
Please upgrade to FortiSwitch version 6.4.11 or above 
Please upgrade to FortiNDR version 7.2.0 or above 
Please upgrade to FortiNDR version 7.1.1 or above 
Please upgrade to FortiNDR version 7.0.5 or above 
Please upgrade to FortiMail version 7.2.0 or above 
Please upgrade to FortiMail version 7.0.4 or above 
Please upgrade to FortiMail version 6.4.7 or above