CVE-2022-30298

CWE-269 — Improper Privilege Management4 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 70.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortisoarFortinet Fortinet Fortisoar
Timeline
PublishedSep 6
Latest updateSep 7

Description

An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system files (via another, unrelated and hypothetical exploit) to execute arbitrary Python commands as root.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortisoar7.0.0 — 7.0.3+2
▶CVEListV5fortinet/fortinet_fortisoarFortiSOAR 7.2.0, 7.0.2, 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.1, 6.4.0

🔴Vulnerability Details

2
GHSA
GHSA-7mwv-v7fm-5jwc: An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7↗2022-09-07
▶
CVEList
CVE-2022-30298: An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7↗2022-09-06
▶

📋Vendor Advisories

1
Fortinet
An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has al...↗2022-09-06
▶
CVE-2022-30298 (HIGH CVSS 7.8) | An improper privilege management vu | cvebase.io