Riskcovery

CVE-2022-27488

State
Published
Severity
7.5 High
Published
Dec 13, 2023
Updated
Aug 3, 2024
Reserved
Mar 21, 2022

Read the record on cve.org

Description

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:Cfortinet

Weaknesses

  • CWE-352 Execute unauthorized code or commands

Affected Products

ProductVersions
FortiVoiceFortinet
  • 6.4.0 through 6.4.7Affected
  • 6.0.0 through 6.0.11Affected
FortiRecorderFortinet
  • 6.4.0 through 6.4.2Affected
  • 6.0.0 through 6.0.11Affected
  • 2.7.0 through 2.7.7Affected
  • 2.6.0 through 2.6.3Affected
FortiSwitchFortinet
  • 7.0.0 through 7.0.4Affected
  • 6.4.0 through 6.4.10Affected
  • 6.2.0 through 6.2.8Affected
  • 6.0.0 through 6.0.7Affected
FortiNDRFortinet
  • 7.1.0Affected
  • 7.0.0 through 7.0.4Affected
  • 1.5.0 through 1.5.3Affected
  • 1.4.0Affected
  • 1.3.0 through 1.3.1Affected
  • 1.2.0Affected
  • 1.1.0Affected
FortiMailFortinet
  • 7.0.0 through 7.0.3Affected
  • 6.4.0 through 6.4.6Affected
  • 6.2.0 through 6.2.9Affected
  • 6.0.0 through 6.0.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.