CRITICAL🇬🇧 English

CVE-2023-33299

CVSS 9.8v3.1pub. 2023-06-23upd. 2024-11-21

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Fortinet Fortinac

    APP
    Fortinet
    7.2.07.2.18.3.79.4.09.4.19.4.29.2.0 – 9.2.79.1.0 – 9.1.98.8.0 – 8.8.118.7.0 – 8.7.68.6.0 – 8.6.58.5.0 – 8.5.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Deserialization
CWE
Referencje

Powiązane podatności

CVE-2022-38375CRITICAL9.1ten sam produkt

An improper authorization vulnerability [CWE-285]  in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before...

CVE-2022-39952CRITICAL9.8ten sam produkt

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 throug...

CVE-2023-22633HIGH7.5ten sam produkt

An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC...

CVE-2022-39946HIGH7.6ten sam produkt

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 al...

CVE-2022-39953HIGH7.8ten sam produkt

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 throu...