CVE-2022-39946 : An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, v

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

Published 2023-06-13 09:15:15

Updated 2023-06-16 18:40:16

Source Fortinet, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-39946

Fortinet » Fortinac
Versions from including (>=) 9.2.0 and up to, including, (<=) 9.2.8
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac
Versions from including (>=) 8.7.0 and up to, including, (<=) 8.7.6
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac
Versions from including (>=) 8.8.0 and up to, including, (<=) 8.8.11
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac
Versions from including (>=) 9.1.0 and up to, including, (<=) 9.1.10
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac
Versions from including (>=) 8.5.0 and up to, including, (<=) 8.5.4
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac
Versions from including (>=) 8.6.0 and up to, including, (<=) 8.6.5
cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac » Version: 9.4.0
cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac » Version: 9.4.1
cpe:2.3:a:fortinet:fortinac:9.4.1:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortinac » Version: 9.4.2
cpe:2.3:a:fortinet:fortinac:9.4.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-39946

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-39946

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	2.8	4.7	Fortinet, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: Low

References for CVE-2022-39946

https://fortiguard.com/psirt/FG-IR-22-332

PSIRT Advisories | FortiGuard
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-39946

Products affected by CVE-2022-39946

Exploit prediction scoring system (EPSS) score for CVE-2022-39946

CVSS scores for CVE-2022-39946

References for CVE-2022-39946