Vulnerability · Published Jun 13, 2023 · Assigned by fortinet
CVE-2022-41327
High 7.6
In plain English
A high-severity security flaw in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.2.0 – through 7.2.37.0.0 – through 7.0.8 |
| Fortinet | FortiProxy | 7.2.0 – through 7.2.17.0.0 – through 7.0.7 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C