8.8

CVE-2022-27488

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiai Version1.1.0
Fortinet ≫ Fortiai Version1.5.3
Fortinet ≫ Fortimail Version >= 6.0.0 <= 6.0.12
Fortinet ≫ Fortimail Version >= 6.2.0 <= 6.2.9
Fortinet ≫ Fortimail Version >= 6.4.0 <= 6.4.6
Fortinet ≫ Fortimail Version >= 7.0.0 <= 7.0.3
Fortinet ≫ FortiNDR Version >= 7.0.0 <= 7.0.4
Fortinet ≫ FortiNDR Version7.1.0
Fortinet ≫ Fortirecorder Version >= 2.6.0 <= 2.6.3
Fortinet ≫ Fortirecorder Version >= 2.7.0 <= 2.7.7
Fortinet ≫ Fortirecorder Version >= 6.0.0 <= 6.0.11
Fortinet ≫ Fortirecorder Version >= 6.4.0 <= 6.4.2
Fortinet ≫ Fortivoice Version >= 6.0.0 <= 6.0.11
Fortinet ≫ Fortivoice Version >= 6.4.0 <= 6.4.7
Fortinet ≫ Fortiswitch Version >= 6.0.0 <= 6.0.7
Fortinet ≫ Fortiswitch Version >= 6.2.0 <= 6.2.7
Fortinet ≫ Fortiswitch Version >= 6.4.0 <= 6.4.10
Fortinet ≫ Fortiswitch Version >= 7.0.0 <= 7.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.44% 0.623
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
psirt@fortinet.com 8.3 2.8 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.