CVE-2022-41327

State: Published
Severity: 7.6 High
Published: Jun 13, 2023
Updated: Oct 23, 2024
Reserved: Sep 23, 2022

Description

A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C	fortinet

Weaknesses

CWE-319 Information disclosure

Affected Products

Product	Versions
FortiOSFortinet	7.2.0 through 7.2.3Affected 7.0.0 through 7.0.8Affected
FortiProxyFortinet	7.2.0 through 7.2.1Affected 7.0.0 through 7.0.7Affected

References

https://fortiguard.com/psirt/FG-IR-22-380

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.