CVE-2022-41329: Infoleak
First published: Tue Mar 07 2023(Updated: )
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<=7.0.8 | |
| Fortinet FortiProxy | >=7.2.0<=7.2.2 | |
| Fortinet FortiOS | >=6.2.3<=6.2.13 | |
| Fortinet FortiOS | >=6.4.0<=6.4.11 | |
| Fortinet FortiOS | >=7.0.0<=7.0.9 | |
| Fortinet FortiOS | >=7.2.0<=7.2.3 |
Remedy
Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above Please upgrade to FortiOS version 7.2.4 or above Please upgrade to FortiOS version 7.0.10 or above Please upgrade to FortiOS version 6.4.11 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-41329?
CVE-2022-41329 is an exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiProxy and FortiOS.
How does CVE-2022-41329 affect Fortinet FortiProxy?
CVE-2022-41329 affects Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7.
How does CVE-2022-41329 affect Fortinet FortiOS?
CVE-2022-41329 affects Fortinet FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9.
What is the severity of CVE-2022-41329?
CVE-2022-41329 has a severity score of 5.3 (Medium).
How can I fix CVE-2022-41329?
To fix CVE-2022-41329, update Fortinet FortiProxy to version 7.2.2 or higher and update Fortinet FortiOS to version 7.2.3 or higher.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.8
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.2
- canonical/fortinet fortios
- version/fortinet fortios/6.2.3
- version/fortinet fortios/6.2.13
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.11
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.9
- version/fortinet fortios/7.2.0
- version/fortinet fortios/7.2.3