CVE-2022-41327
First published: Tue Jun 13 2023(Updated: )
A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<=7.0.7 | |
| Fortinet FortiProxy | =7.2.0 | |
| Fortinet FortiProxy | =7.2.1 | |
| Fortinet FortiOS | >=7.0.0<=7.0.8 | |
| Fortinet FortiOS | >=7.2.0<=7.2.4 |
Remedy
Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.9 or above Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-41327?
CVE-2022-41327 is a cleartext transmission of sensitive information vulnerability in Fortinet FortiOS versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.8, as well as FortiProxy versions 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8.
How does CVE-2022-41327 affect Fortinet FortiOS and FortiProxy?
CVE-2022-41327 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in cleartext, potentially exposing sensitive information.
What is the severity of CVE-2022-41327?
CVE-2022-41327 has a severity value of 4.4, which is considered high.
How can I fix CVE-2022-41327?
To fix CVE-2022-41327, it is recommended to upgrade to the latest version of Fortinet FortiOS or FortiProxy, as specified in the vendor's security advisory.
Where can I find more information about CVE-2022-41327?
You can find more information about CVE-2022-41327 in the vendor's security advisory at the following link: [Fortinet Advisory](https://fortiguard.com/psirt/FG-IR-22-380).
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.7
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.1
- canonical/fortinet fortios
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.8
- version/fortinet fortios/7.2.0
- version/fortinet fortios/7.2.4