CVE-2022-42476: Path Traversal
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.
Other sources
A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 6.2.13 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 6.4.12 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
Fortinet FortiProxyto a version that resolves this vulnerability.Fixed in 2.0.12 - Upgrade
Upgrade
Fortinet FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.8 - Upgrade
Upgrade
Fortinet FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.2
Event History
Frequently Asked Questions
What is CVE-2022-42476?
CVE-2022-42476 is a relative path traversal vulnerability in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, and before 6.4.11, as well as in FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8.
How severe is CVE-2022-42476?
CVE-2022-42476 has a severity rating of 8.2, which is considered high.
How does CVE-2022-42476 affect Fortinet FortiOS?
CVE-2022-42476 affects Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, and before 6.4.11.
How does CVE-2022-42476 affect FortiProxy?
CVE-2022-42476 affects FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8.
How can I mitigate the risk of CVE-2022-42476?
To mitigate the risk of CVE-2022-42476, it is recommended to update Fortinet FortiOS to version 6.4.11, 7.0.8, or 7.2.3, and FortiProxy to version 7.0.8 or 7.2.3.