Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-27488

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiVoice

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.7affected
  • 6.0.0 to ≤ 6.0.11affected

Fortinet FortiRecorder

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.2affected
  • 6.0.0 to ≤ 6.0.11affected
  • 2.7.0 to ≤ 2.7.7affected
  • 2.6.0 to ≤ 2.6.3affected

Fortinet FortiSwitch

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.4affected
  • 6.4.0 to ≤ 6.4.10affected
  • 6.2.0 to ≤ 6.2.8affected
  • 6.0.0 to ≤ 6.0.7affected

Fortinet FortiNDR

Default version status: unaffected

  • 7.1.0affected
  • 7.0.0 to ≤ 7.0.4affected
  • 1.5.0 to ≤ 1.5.3affected
  • 1.4.0affected
  • 1.3.0 to ≤ 1.3.1affected
  • 1.2.0affected
  • 1.1.0affected

Fortinet FortiMail

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.3affected
  • 6.4.0 to ≤ 6.4.6affected
  • 6.2.0 to ≤ 6.2.9affected
  • 6.0.0 to ≤ 6.0.12affected

References