{"id":"CVE-2022-43950","state":"PUBLISHED","title":"A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, \r","description":"A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, \r\n 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL.","publishedAt":"2023-05-03T21:26:50.797Z","updatedAt":"2024-10-22T20:46:32.741Z","severity":{"score":3.9,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiNAC"],"affected":[{"vendor":"Fortinet","product":"FortiNAC","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.1","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.7","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.9","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.11","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThanOrEqual":"8.7.6","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-407"],"weaknesses":["CWE-601"],"ingestedAt":"2026-10-29T19:50:43.581Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/43xxx/CVE-2022-43950.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-43950","state":"PUBLISHED","datePublished":"2023-05-03T21:26:50.797Z","dateUpdated":"2024-10-22T20:46:32.741Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-10-27T07:40:06.589Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, \r\n 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL."}],"affected":[{"vendor":"Fortinet","product":"FortiNAC","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.1","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.7","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.9","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.11","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThanOrEqual":"8.7.6","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-407","name":"https://fortiguard.com/psirt/FG-IR-22-407"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-05-03T21:26:50.797Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiNAC version 9.4.2 or above\r\nPlease upgrade to FortiNAC-F version 7.2.1 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-407","name":"https://fortiguard.com/psirt/FG-IR-22-407","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T13:47:04.368Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T20:18:07.298715Z","id":"CVE-2022-43950","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T20:46:32.741Z"}}]}}}