Fortinet PSIRT Monthly Advisories — February 2023
Tuesday, 14 February 2023
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 2
-
Critical 9.8
CVE-2022-39952 Public exploit Scanner template A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.…EPSS 100%
-
Critical 9.3
CVE-2021-42756 Public exploit Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and be…EPSS 35%
All vulnerabilities 37
Critical2 ShowHide
-
Critical 9.8
CVE-2022-39952 Public exploit Scanner template A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.…EPSS 100%
-
Critical 9.3
CVE-2021-42756 Public exploit Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and be…EPSS 35%
High14 ShowHide
-
High 8.6
CVE-2022-30303 An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6…EPSS 2.5%
-
High 8.6
CVE-2022-38375 An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform …EPSS 1.1%
- High 8.6
- High 8.6
-
High 8.5
CVE-2021-42761 A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6…EPSS 1.5%
-
High 8.0
CVE-2022-33869 An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may all…EPSS 1.3%
- High 7.6
- High 7.4
- High 7.4
- High 7.4
- High 7.2
- High 7.1
- High 7.1
-
High 7.0
CVE-2022-27489 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and be…EPSS 1.5%
Medium20 ShowHide
- Medium 6.9
- Medium 6.7
-
Medium 6.6
CVE-2023-23779 Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and belo…EPSS 1.3%
- Medium 6.5
- Medium 6.3
- Medium 6.3
- Medium 6.2
- Medium 6.1
- Medium 6.0
- Medium 5.8
- Medium 5.6
- Medium 5.4
- Medium 5.0
- Medium 4.7
- Medium 4.4
- Medium 4.2
- Medium 4.1
- Medium 4.1
- Medium 4.0
- Medium 4.0