CVE-2022-39954CWE-611

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC…

Medium · published February 16, 2023

CVSS v3.1
6.9
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-02-16T18:06Z
EPSS history
Timeline
  • 16 FEB 18:06Z
    An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC…
    cvelistv5