Fortinet Products Multiple Vulnerabilities

Group of hackers trying to attack a vulnerable computers using varies exploitations Group of hackers trying to attack a vulnerable computers using varies exploitations DALL-E

Fortinet Products Multiple Vulnerabilities

Threat Level: High

Components Affected

  • FortiNAC version 9.4.0
  • FortiNAC version 9.2.0 through 9.2.5
  • FortiNAC version 9.1.0 through 9.1.7
  • FortiNAC 8.8 all versions
  • FortiNAC 8.7 all versions
  • FortiNAC 8.6 all versions
  • FortiNAC 8.5 all versions
  • FortiNAC 8.3 all versions
  • FortiWeb versions 6.4 all versions
  • FortiWeb versions 6.3.16 and below
  • FortiWeb versions 6.2.6 and below
  • FortiWeb versions 6.1.2 and below
  • FortiWeb versions 6.0.7 and below
  • FortiWeb versions 5.x all versions

Overview

Multiple products of Fortinet were found to be vulnerable. This vulnerability can be exploited by a remote attacker to perform security restriction bypass, denial of service, information disclosure, cross-site scripting, and elevation of privilege on the targeted system.

Description

Fortinet has identified two vulnerabilities in FortiNAC and FortiWeb products which could allow unauthenticated attackers to perform arbitrary code or command execution. The first vulnerability impacting FortiNAC, is tracked as CVE-2022-39952, where an external control of file name or path vulnerability [CWE-73] in FortiNAC webserver may allow an unauthenticated attacker to perform arbitrary write on the system. The second vulnerability that impacts FortiWeb is CVE-2021-42756, multiple stack-based buffer overflow vulnerabilities [CWE-121] in FortiWeb's proxy daemon may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

Impact

  • Security Restriction Bypass
  • Denial of Service
  • Information Disclosure
  • Cross-Site Scripting
  • Elevation of Privilege 

Solution/ Workarounds

To fix the issues users are advised to follow the vendor’s recommendation by updating to the latest version of the Fortinet products.

https://www.fortiguard.com/psirt/FG-IR-22-300

https://www.fortiguard.com/psirt/FG-IR-21-186 

Reference

Disclaimer

The information provided herein is on an "as is" basis, without warranty of any kind.

Rate this item
(0 votes)
K Dinesh Kumara

Founder of PC World Online Magazine

I'm an educator, entrepreneur, and career guidance officer. I'm interested in ICT, psychology, financial literacy, meditation, and yogic sciences. My hobbies are discovering, learning, experiencing, sharing, and exiling.

Leave a comment

Attention readers: Starting from 15-05-2023, we will be reviewing all comments submitted through our website's comment section before publishing them. This change is due to the increased volume of spam comments we have been receiving. We appreciate your understanding and apologize for any delays this may cause. Thank you for your continued support and valuable contributions to our platform.

Dear valued users,

We welcome you to the PC World Magazine Website and appreciate your interest in commenting on our articles. This platform is intended for thoughtful discussions and exchanging ideas and information related to the topic of the article. However, please be mindful that we do not tolerate any illegal activities or marketing purposes. Misusing the comment section for such purposes will result in the immediate removal of the comment and could result in the termination of your account. We ask that you keep your comments respectful, on-topic, and relevant to the article. Additionally, please do not post personal information, hate speech, or offensive content. Thank you for your cooperation in creating a positive and productive environment for all users on the PC World Magazine Website.

Best regards,
PC World Magazine Team

The Technology Video of The Day

Email Newsletter Subscription

Fill out the subscription form by providing your email address and name. Click on the "Subscribe" button to complete the process.


Receive HTML?

Thank you for choosing to stay updated with our latest news and offerings!
Joomla Extensions powered by Joobi

Articles Calendar

« March 2024 »
Mon Tue Wed Thu Fri Sat Sun
        1 2 3
4 5 6 7 8 9 10
11 12 13 14 15 16 17
18 19 20 21 22 23 24
25 26 27 28 29 30 31

Articles Archive

Go to top