Vulnerability · Published Apr 11, 2023 · Assigned by fortinet
CVE-2022-27487
High 8.3
In plain English
A high-severity privilege mismanagement in FortiDeceptor from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)1.0%top 37.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiDeceptor | 4.1.04.0.0 – through 4.0.23.3.0 – through 3.3.33.2.0 – through 3.2.23.1.0 – through 3.1.13.0.0 – through 3.0.22.1.02.0.0 |
| Fortinet | FortiSandbox | 4.2.0 – through 4.2.24.0.0 – through 4.0.23.2.0 – through 3.2.33.1.0 – through 3.1.53.0.0 – through 3.0.72.5.0 – through 2.5.2 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C