CVE-2022-38378
First published: Thu Feb 16 2023(Updated: )
An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=1.1.0<=2.0.9 | |
| Fortinet FortiProxy | >=7.0.0<7.0.8 | |
| Fortinet FortiProxy | >=7.2.0<7.2.2 | |
| Fortinet FortiOS | >=6.0.0<7.0.8 | |
| Fortinet FortiOS | >=7.2.0<7.2.1 |
Remedy
Please upgrade to FortiOS version 7.2.1 or above Please upgrade to FortiOS version 7.0.8 or above Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-38378.
What is the severity level of CVE-2022-38378?
CVE-2022-38378 has a severity level of medium.
Which software versions are affected by CVE-2022-38378?
Fortinet FortiOS versions 7.2.0 and before 7.0.7, and FortiProxy versions 7.2.0 through 7.2.1 and before 7.0.7 are affected by CVE-2022-38378.
How can an attacker exploit CVE-2022-38378?
An attacker with access to the admin profile section in the System subsection Administrator Users can exploit CVE-2022-38378 to modify their own profile.
Are there any references available for more information about CVE-2022-38378?
Yes, you can find more information about CVE-2022-38378 at the following reference: [FG-IR-22-346](https://fortiguard.com/psirt/FG-IR-22-346).
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/1.1.0
- version/fortinet fortiproxy/2.0.9
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.2.0
- canonical/fortinet fortios
- version/fortinet fortios/6.0.0
- version/fortinet fortios/7.2.0