Vulnerability · Published Feb 16, 2023 · Assigned by fortinet
CVE-2022-38378
Medium 4.0
In plain English
A medium-severity privilege mismanagement in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.2.07.0.0 – through 7.0.76.4.0 – through 6.4.116.2.0 – through 6.2.126.0.0 – through 6.0.16 |
| Fortinet | FortiProxy | 7.2.0 – through 7.2.17.0.0 – through 7.0.72.0.0 – through 2.0.111.2.0 – through 1.2.131.1.0 – through 1.1.6 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C