CVE-2022-26120

CWE-89 — SQL Injection4 documents4 sources

Severity

8.8HIGH

EPSS

0.6%

top 29.75%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortiadc Fortinet Fortinet Fortiadc

Timeline

PublishedJul 18

Latest updateJul 19

Description

Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDfortinet/fortiadc5.0.0 — 6.2.3+2

▶CVEListV5fortinet/fortinet_fortiadcFortiADC 7.0.0 through 7.0.1, 5.0.0 through 6.2.2

🔴Vulnerability Details

GHSA

GHSA-r9jw-vjf4-w774: Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interfac↗2022-07-19

▶

CVEList

CVE-2022-26120: Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interfac↗2022-07-18

▶

📋Vendor Advisories

Fortinet

Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] i...↗2022-07-18

▶