Fortinet Fortinac vulnerabilities

CVE-2022-40678 [HIGH] CWE-522 CVE-2022-40678: An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9. An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.

CVE-2023-22638 [HIGH] CWE-79 CVE-2023-22638: Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in Forti Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests.

CVE-2022-38376 [MEDIUM] CWE-79 CVE-2022-38376: Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulner Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.

CVE-2022-26117 [HIGH] CWE-521 CVE-2022-26117: An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.

CVE-2022-26116 [HIGH] CWE-89 CVE-2022-26116: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerab Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via speci

CVE-2021-43065 [HIGH] CWE-732 CVE-2021-43065: A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data.

CVE-2021-41021 [HIGH] CVE-2021-41021: A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may al A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command.

CVE-2021-24011 [MEDIUM] CVE-2021-24011: A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to esca A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.

CVE-2020-12816 [MEDIUM] CWE-79 CVE-2020-12816: An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authen An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.

CVE-2019-5594 [MEDIUM] CWE-79 CVE-2019-5594: An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.