| IR Number | FG-IR-22-432 |
| Date | Apr 11, 2023 |
| Severity |
Medium |
| CVSSv3 Score | 6.5 |
| Impact | Information disclosure |
| CVE ID | CVE-2022-42477 |
| Affected Products |
FortiAnalyzer
:
7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.10, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0
FortiManager
:
7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.11, 6.4.10, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiAnalyzer & FortiManager - Improper input validation in custom dataset
Summary
An improper input validation vulnerability [CWE-20] in FortiAnalyzer & FortiManager may allow an authenticated attacker to disclose file system information via custom dataset SQL queries.
Workaround:
If enabled, disabled the FortiAnalyzer features option in FortiManager via:
```
config system global
set faz-status disable
end
```
FortiManager 100C is not impacted due to the absence of FortiAnalyzer features option.
Affected Products
FortiAnalyzer version 7.2.1 and below,
FortiAnalyzer version 7.0.6 and below,
FortiAnalyzer 6.4 all versions.
FortiManager version 7.2.0 through 7.2.2.
FortiManager version 7.0.0 through 7.0.7.
FortiManager version 6.4.0 through 6.4.11.
FortiManager version 6.2.0 through 6.2.10.
FortiManager version 6.0.1 through 6.0.11.
Solutions
Please upgrade to FortiAnalyzer version 7.2.2 or abovePlease upgrade to FortiAnalyzer version 7.0.7 or above
Please upgrade to FortiAnalyzer version 6.4.12 or above
Please upgrade to FortiManager version 7.2.2 or above
Please upgrade to FortiManager version 7.0.7 or above
Please upgrade to FortiManager version 6.4.12 or above
Acknowledgement
Fortinet is pleased to thank Darmin Blazevic (Fujitsu Services GmbH) for bringing this issue to our attention under responsible disclosure.Timeline
2023-03-23: Initial publication