CVE-2022-39946CWE-284

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions…

High · published June 13, 2023

CVSS v3.1
7.2
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.00717 · 53.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-06-13T08:41Z
EPSS history
Timeline
  • 13 JUN 08:41Z
    An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions…
    cvelistv5