CRITICAL🇵🇱 Wersja polska

CVE-2023-33299

CVSS 9.8v3.1pub. 2023-06-23upd. 2024-11-21

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Fortinet Fortinac

    APP
    Fortinet
    7.2.07.2.18.3.79.4.09.4.19.4.29.2.0 – 9.2.79.1.0 – 9.1.98.8.0 – 8.8.118.7.0 – 8.7.68.6.0 – 8.6.58.5.0 – 8.5.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Deserialization
CWE
References

Related vulnerabilities

CVE-2022-38375CRITICAL9.1PL ✓same product

Nieprawidłowa autoryzacja w Fortinet FortiNAC — dostęp administracyjny bez uwierzytelnienia

CVE-2022-39952CRITICAL9.8PL ✓same product

RCE bez uwierzytelnienia w Fortinet FortiNAC przez kontrolę ścieżki pliku

CVE-2023-22633HIGH7.5same product

An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC...

CVE-2022-39946HIGH7.6same product

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 al...

CVE-2022-39953HIGH7.8same product

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 throu...