A vulnerability was found in Fortinet FortiManager up to 6.2.8/6.4.6/7.0.1. It has been rated as problematic. This issue affects an unknown part of the component Config File Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality.

The weakness was disclosed 03/02/2022 as FG-IR-21-165. The advisory is shared at fortiguard.com. The identification of this vulnerability is CVE-2022-22303 since 01/03/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 6.2.9, 6.4.7 or 7.0.2 eliminates this vulnerability.

Productinfo

Vendor

• Fortinet

Name

• FortiManager

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 7.0.0
• 7.0.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion