CVE-2022-27484

CWE-287 — Improper AuthenticationCWE-863 — Incorrect Authorization4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 67.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiadcFortinet Fortinet Fortiadc
Timeline
PublishedAug 3
Latest updateAug 4

Description

A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDfortinet/fortiadc5.0.0 — 6.2.4
▶CVEListV5fortinet/fortinet_fortiadcFortiADC 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.6, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.3, 5.1.2, 5.1.1, 5.1.0, 5.0.4, 5.0.3, 5.0.2, 5.0.1, 5.0.0

🔴Vulnerability Details

2
GHSA
GHSA-m2v6-594j-3c6p: A unverified password change in Fortinet FortiADC version 6↗2022-08-04
▶
CVEList
CVE-2022-27484: A unverified password change in Fortinet FortiADC version 6↗2022-08-03
▶

📋Vendor Advisories

1
Fortinet
A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticat...↗2022-08-03
▶
CVE-2022-27484 (MEDIUM CVSS 4.3) | A unverified password change in For | cvebase.io