Unverified password change over the GUI Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-055 Final 1 1 2022-08-02T00:00:00 Current version 2022-08-02T00:00:00 2022-08-02T00:00:00 An unverified password change vulnerability [CWE-620] in FortiADC may allow an authenticated attacker to bypass the Old Password check in the password change form for the account the attacker is logged into or for others accounts except admin when the attacker has Read Write access on System via a crafted HTTP request . None Improper access control At leastFortiADC 7.1 all versions are not affectedFortiADC 7.0 all versions are not affectedFortiADC version 6.2.0 through 6.2.3FortiADC 6.1 all versionsFortiADC 6.0 all versionsFortiADC 5.4 all versionsFortiADC 5.3 all versionsFortiADC 5.2 all versionsFortiADC 5.1 all versionsFortiADC 5.0 all versions Please upgrade to FortiADC version 7.0.0 or above,Please upgrade to FortiADC version 6.2.4 or above. Internally discovered and reported by Théo Leleu of Fortinet Product Security team. FortiADC 6.2.3 FortiADC 6.2.2 FortiADC 6.2.1 FortiADC 6.2.0 FortiADC 6.1.6 FortiADC 6.1.5 FortiADC 6.1.4 FortiADC 6.1.3 FortiADC 6.1.2 FortiADC 6.1.1 FortiADC 6.1.0 FortiADC 6.0.4 FortiADC 6.0.3 FortiADC 6.0.2 FortiADC 6.0.1 FortiADC 6.0.0 FortiADC 5.4.5 FortiADC 5.4.4 FortiADC 5.4.3 FortiADC 5.4.2 FortiADC 5.4.1 FortiADC 5.4.0 FortiADC 5.3.7 FortiADC 5.3.6 FortiADC 5.3.5 FortiADC 5.3.4 FortiADC 5.3.3 FortiADC 5.3.2 FortiADC 5.3.1 FortiADC 5.3.0 FortiADC 5.2.8 FortiADC 5.2.7 FortiADC 5.2.6 FortiADC 5.2.5 FortiADC 5.2.4 FortiADC 5.2.3 FortiADC 5.2.2 FortiADC 5.2.1 FortiADC 5.2.0 FortiADC 5.1.7 FortiADC 5.1.6 FortiADC 5.1.5 FortiADC 5.1.4 FortiADC 5.1.3 FortiADC 5.1.2 FortiADC 5.1.1 FortiADC 5.1.0 FortiADC 5.0.4 FortiADC 5.0.3 FortiADC 5.0.2 FortiADC 5.0.1 FortiADC 5.0.0 CVE-2022-27484 FortiADC-6.2.3 FortiADC-6.2.2 FortiADC-6.2.1 FortiADC-6.2.0 FortiADC-6.1.6 FortiADC-6.1.5 FortiADC-6.1.4 FortiADC-6.1.3 FortiADC-6.1.2 FortiADC-6.1.1 FortiADC-6.1.0 FortiADC-6.0.4 FortiADC-6.0.3 FortiADC-6.0.2 FortiADC-6.0.1 FortiADC-6.0.0 FortiADC-5.4.5 FortiADC-5.4.4 FortiADC-5.4.3 FortiADC-5.4.2 FortiADC-5.4.1 FortiADC-5.4.0 FortiADC-5.3.7 FortiADC-5.3.6 FortiADC-5.3.5 FortiADC-5.3.4 FortiADC-5.3.3 FortiADC-5.3.2 FortiADC-5.3.1 FortiADC-5.3.0 FortiADC-5.2.8 FortiADC-5.2.7 FortiADC-5.2.6 FortiADC-5.2.5 FortiADC-5.2.4 FortiADC-5.2.3 FortiADC-5.2.2 FortiADC-5.2.1 FortiADC-5.2.0 FortiADC-5.1.7 FortiADC-5.1.6 FortiADC-5.1.5 FortiADC-5.1.4 FortiADC-5.1.3 FortiADC-5.1.2 FortiADC-5.1.1 FortiADC-5.1.0 FortiADC-5.0.4 FortiADC-5.0.3 FortiADC-5.0.2 FortiADC-5.0.1 FortiADC-5.0.0 5.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-22-055 Unverified password change over the GUI Reference>