CVE-2022-27487
First published: Tue Apr 11 2023(Updated: )
A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiDeceptor | >=1.0<3.3.3 | |
| Fortinet FortiDeceptor | >=4.0.0<=4.0.2 | |
| Fortinet FortiDeceptor | =4.1.0 | |
| Fortinet FortiSandbox | >=2.5.0<3.2.4 | |
| Fortinet FortiSandbox | >=4.0.0<4.0.3 | |
| Fortinet FortiSandbox | >=4.2.0<4.2.3 |
Remedy
Please upgrade to FortiDeceptor version 4.2.0 or above Please upgrade to FortiDeceptor version 4.1.1 or above Please upgrade to FortiDeceptor version 4.0.2 or above Please upgrade to FortiDeceptor version 3.3.3 or above Please upgrade to FortiSandbox version 4.2.3 or above Please upgrade to FortiSandbox version 4.0.3 or above Please upgrade to FortiSandbox version 3.2.4 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-27487.
What is the severity of CVE-2022-27487?
The severity of CVE-2022-27487 is high with a CVSS score of 8.8.
Which software versions are affected by CVE-2022-27487?
Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2, and versions before 3.2.3, as well as Fortinet FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2, and versions before 3.3.3 are affected.
How can this vulnerability be exploited?
A remote authenticated attacker can exploit CVE-2022-27487 by performing unauthorized API calls via crafted HTTP or HTTPS requests.
Is there a fix available for CVE-2022-27487?
Yes, Fortinet has released a fix for CVE-2022-27487. It is recommended to update to the latest patched version of FortiSandbox and FortiDeceptor.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/remedy
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/fortinet
- canonical/fortinet fortideceptor
- version/fortinet fortideceptor/1.0
- version/fortinet fortideceptor/4.0.0
- version/fortinet fortideceptor/4.0.2
- version/fortinet fortideceptor/4.1.0
- canonical/fortinet fortisandbox
- version/fortinet fortisandbox/2.5.0
- version/fortinet fortisandbox/4.0.0
- version/fortinet fortisandbox/4.2.0