{"id":"CVE-2022-38377","state":"PUBLISHED","title":"An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.","description":"An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information.","publishedAt":"2022-11-25T15:47:41.422Z","updatedAt":"2024-10-22T20:52:08.654Z","severity":{"score":4.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiManager","Fortinet FortiAnalyzer"],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.11","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.11","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-20-143"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T19:50:26.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/38xxx/CVE-2022-38377.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-38377","state":"PUBLISHED","datePublished":"2022-11-25T15:47:41.422Z","dateUpdated":"2024-10-22T20:52:08.654Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","requesterUserId":"a0475cc0-be89-4a25-97b3-d1b8023a8677","dateReserved":"2022-08-16T14:17:48.479Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information."}],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.11","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.8","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.11","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-143","name":"https://fortiguard.com/psirt/FG-IR-20-143"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2022-11-25T15:47:41.422Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiManager version 7.2.1 or above\r\nPlease upgrade to FortiManager version 7.0.4 or above\r\nPlease upgrade to FortiManager version 6.4.8 or above\n\r\nPlease upgrade to FortiAnalyzer version 7.2.1 or above\r\nPlease upgrade to FortiAnalyzer version 7.0.4 or above\r\nPlease upgrade to FortiAnalyzer version 6.4.9 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-143","name":"https://fortiguard.com/psirt/FG-IR-20-143","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T10:54:03.674Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T20:18:55.318018Z","id":"CVE-2022-38377","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T20:52:08.654Z"}}]}}}