| IR Number | FG-IR-22-056 |
| Date | Apr 11, 2023 |
| Severity |
High |
| CVSSv3 Score | 8.3 |
| Impact | Execute unauthorized code or commands |
| CVE ID | CVE-2022-27487 |
| Affected Products |
FortiDeceptor
:
4.1.0, 4.0.2, 4.0.1, 4.0.0, 3.3.3, 3.3.2, 3.3.1, 3.3.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.2, 3.0.1, 3.0.0, 2.1.0, 2.0.0, 1.1.0, 1.0.1, 1.0.0
FortiSandbox
:
4.2.2, 4.2.1, 4.2.0, 4.0.2, 4.0.1, 4.0.0, 3.2.3, 3.2.2, 3.2.1, 3.2.0, 3.1.5, 3.1.4, 3.1.3, 3.1.2, 3.1.1, 3.1.0, 3.0.7, 3.0.6, 3.0.5, 3.0.4, 3.0.3, 3.0.2, 3.0.1, 3.0.0, 2.5.2, 2.5.1, 2.5.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiSandbox / FortiDeceptor - Improper profile-based access control over APIs
Summary
An improper privilege management vulnerability [CWE-269] in FortiSandbox & FortiDeceptor may allow a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.
Affected Products
FortiDeceptor version 4.1.0
FortiDeceptor version 4.0.0 through 4.0.2
FortiDeceptor version 3.3.0 through 3.3.3
FortiDeceptor 3.2 all versions
FortiDeceptor 3.1 all versions
FortiDeceptor 3.0 all versions
FortiDeceptor 2.1 all versions
FortiDeceptor 2.0 all versions
FortiDeceptor 1.1 all versions
FortiDeceptor 1.0 all versions
At least
FortiSandbox version 4.2.0 through 4.2.2
FortiSandbox version 4.0.0 through 4.0.2
FortiSandbox version 3.2.0 through 3.2.3
FortiSandbox 3.1 all versions
FortiSandbox 3.0 all versions
FortiSandbox 2.5 all versions
Solutions
Please upgrade to FortiDeceptor version 4.2.0 or abovePlease upgrade to FortiDeceptor version 4.1.1 or above
Please upgrade to FortiDeceptor version 4.0.2 or above
Please upgrade to FortiDeceptor version 3.3.3 or above
Please upgrade to FortiSandbox version 4.2.3 or above
Please upgrade to FortiSandbox version 4.0.3 or above
Please upgrade to FortiSandbox version 3.2.4 or above