Refine your search
14 vulnerabilities found for FortiNAC by Fortinet
CERTFR-2024-AVI-0404
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance, une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiProxy | FortiProxy 7.0.x versions antérieures à 7.0.14 | ||
| Fortinet | FortiProxy | FortiProxy 7.4.x versions antérieures à 7.4.2 | ||
| Fortinet | N/A | FortiWebManager 6.0.x toutes versions | ||
| Fortinet | FortiWeb | FortiWeb 7.0.x toutes versions pour la vulnérabilité CVE-2024-23665 | ||
| Fortinet | FortiNAC | FortiNAC 8.7.x toutes versions | ||
| Fortinet | FortiNAC | FortiNAC 8.8.x toutes versions | ||
| Fortinet | FortiWeb | FortiWeb 7.2.x versions antérieures à 7.2.8 | ||
| Fortinet | FortiSOAR | FortiSOAR 7.0.x toutes versions | ||
| Fortinet | N/A | FortiAuthenticator 6.6.x versions antérieures à 6.6.1 | ||
| Fortinet | FortiSOAR | FortiSOAR cyops Connector versions antérieures à 2.1.0 | ||
| Fortinet | FortiNAC | FortiNAC 9.4.x versions antérieures à 9.4.5 | ||
| Fortinet | FortiProxy | FortiProxy 7.2.x versions antérieures à 7.2.8 | ||
| Fortinet | FortiOS | FortiOS 6.4.x toutes versions | ||
| Fortinet | FortiADC | FortiADC 6.2.x toutes versions | ||
| Fortinet | FortiOS | FortiOS 6.0.x toutes versions | ||
| Fortinet | FortiADC | FortiADC 7.4.x versions antérieures à 7.4.2 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager 7.0.x versions antérieures à 7.0.3 | ||
| Fortinet | FortiADC | FortiADC 7.0.x toutes versions | ||
| Fortinet | FortiNAC | FortiNAC 9.2.x toutes versions | ||
| Fortinet | FortiOS | FortiOS 6.2.x toutes versions | ||
| Fortinet | N/A | FortiAuthenticator 6.4.x toutes versions | ||
| Fortinet | FortiOS | FortiOS 7.0.x versions antérieures à 7.0.13 | ||
| Fortinet | FortiPortal | FortiPortal 7.0.x versions antérieures à 7.0.7 | ||
| Fortinet | FortiADC | FortiADC 7.1.x toutes versions | ||
| Fortinet | FortiWeb | FortiWeb 6.3.x toutes versions | ||
| Fortinet | FortiSOAR | FortiSOAR 7.3.x versions antérieures à 7.3.1 | ||
| Fortinet | FortiPAM | FortiPAM 1.1.x versions antérieures à 1.1.1 | ||
| Fortinet | FortiSOAR | FortiSOAR 7.2.x toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.1.x toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 4.4.x versions antérieures à 4.4.5 | ||
| Fortinet | N/A | FortiVoice 7.0.x versions antérieures à 7.0.2 | ||
| Fortinet | FortiProxy | FortiProxy 1.2.x toutes versions | ||
| Fortinet | N/A | FortiWebManager 7.0.x versions antérieures à 7.0.5 | ||
| Fortinet | N/A | FortiWebManager 6.3.x versions antérieures à 6.3.1 | ||
| Fortinet | FortiProxy | FortiProxy 2.0.x toutes versions | ||
| Fortinet | FortiWeb | FortiWeb 7.0.x versions antérieures à 7.0.9 | ||
| Fortinet | FortiWeb | FortiWeb 7.4.x versions antérieures à 7.4.3 | ||
| Fortinet | N/A | FortiWebManager 6.2.x versions antérieures à 6.2.5 | ||
| Fortinet | N/A | FortiVoice 6.0.x toutes versions | ||
| Fortinet | N/A | FortiWebManager 7.2.x versions antérieures à 7.2.1 | ||
| Fortinet | FortiWeb | FortiWeb 6.4.x toutes versions | ||
| Fortinet | FortiOS | FortiOS 7.0 toutes versions pour les vulnérabilités CVE-2023-36640 et CVE-2023-45583 | ||
| Fortinet | FortiPAM | FortiPAM 1.0.x toutes versions | ||
| Fortinet | FortiOS | FortiOS 7.2.x versions antérieures à 7.2.8 | ||
| Fortinet | FortiSandbox | FortiSandbox 4.2.x versions antérieures à 4.2.7 | ||
| Fortinet | FortiPortal | FortiPortal 7.2.x versions antérieures à 7.2.2 | ||
| Fortinet | FortiNAC | FortiNAC 9.1.x toutes versions | ||
| Fortinet | FortiPortal | FortiPortal 6.0.x versions antérieures à 6.0.15 | ||
| Fortinet | N/A | FortiVoice 6.4.x versions antérieures à 6.4.9 | ||
| Fortinet | N/A | FortiAuthenticator 6.5.x versions antérieures à 6.5.4 | ||
| Fortinet | FortiADC | FortiADC 7.2.x versions antérieures à 7.2.4 | ||
| Fortinet | FortiOS | FortiOS 7.4.x versions antérieures à 7.4.2 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager 7.2.x versions antérieures à 7.2.3 | ||
| Fortinet | FortiNAC | FortiNAC 7.2.x versions antérieures à 7.2.4 | ||
| Fortinet | FortiProxy | FortiProxy 1.0.x toutes versions |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiProxy 7.0.x versions ant\u00e9rieures \u00e0 7.0.14",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.4.x versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWebManager 6.0.x toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 7.0.x toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-23665",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 8.7.x toutes versions",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 8.8.x toutes versions",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 7.2.x versions ant\u00e9rieures \u00e0 7.2.8",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR 7.0.x toutes versions",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator 6.6.x versions ant\u00e9rieures \u00e0 6.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR cyops Connector versions ant\u00e9rieures \u00e0 2.1.0",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 9.4.x versions ant\u00e9rieures \u00e0 9.4.5",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.2.x versions ant\u00e9rieures \u00e0 7.2.8",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.4.x toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 6.2.x toutes versions",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.0.x toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 7.4.x versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager 7.0.x versions ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 7.0.x toutes versions",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 9.2.x toutes versions",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.2.x toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator 6.4.x toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.0.x versions ant\u00e9rieures \u00e0 7.0.13",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPortal 7.0.x versions ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "FortiPortal",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 7.1.x toutes versions",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 6.3.x toutes versions",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR 7.3.x versions ant\u00e9rieures \u00e0 7.3.1",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM 1.1.x versions ant\u00e9rieures \u00e0 1.1.1",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR 7.2.x toutes versions",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.1.x toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 4.4.x versions ant\u00e9rieures \u00e0 4.4.5",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiVoice 7.0.x versions ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.2.x toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWebManager 7.0.x versions ant\u00e9rieures \u00e0 7.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWebManager 6.3.x versions ant\u00e9rieures \u00e0 6.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 2.0.x toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 7.0.x versions ant\u00e9rieures \u00e0 7.0.9",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 7.4.x versions ant\u00e9rieures \u00e0 7.4.3",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWebManager 6.2.x versions ant\u00e9rieures \u00e0 6.2.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiVoice 6.0.x toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWebManager 7.2.x versions ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb 6.4.x toutes versions",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.0 toutes versions pour les vuln\u00e9rabilit\u00e9s CVE-2023-36640 et CVE-2023-45583",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM 1.0.x toutes versions",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.2.x versions ant\u00e9rieures \u00e0 7.2.8",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 4.2.x versions ant\u00e9rieures \u00e0 4.2.7",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPortal 7.2.x versions ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiPortal",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 9.1.x toutes versions",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPortal 6.0.x versions ant\u00e9rieures \u00e0 6.0.15",
"product": {
"name": "FortiPortal",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiVoice 6.4.x versions ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator 6.5.x versions ant\u00e9rieures \u00e0 6.5.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 7.2.x versions ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.4.x versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager 7.2.x versions ant\u00e9rieures \u00e0 7.2.3",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 7.2.x versions ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.0.x toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-26007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26007"
},
{
"name": "CVE-2024-27316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27316"
},
{
"name": "CVE-2023-40720",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40720"
},
{
"name": "CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"name": "CVE-2023-48789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48789"
},
{
"name": "CVE-2024-21760",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21760"
},
{
"name": "CVE-2023-44247",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44247"
},
{
"name": "CVE-2024-31493",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31493"
},
{
"name": "CVE-2024-23664",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23664"
},
{
"name": "CVE-2023-50180",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50180"
},
{
"name": "CVE-2024-23670",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23670"
},
{
"name": "CVE-2024-3302",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3302"
},
{
"name": "CVE-2024-27983",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27983"
},
{
"name": "CVE-2023-45583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45583"
},
{
"name": "CVE-2024-31488",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31488"
},
{
"name": "CVE-2023-46714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46714"
},
{
"name": "CVE-2024-23667",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23667"
},
{
"name": "CVE-2024-23107",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23107"
},
{
"name": "CVE-2024-23105",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23105"
},
{
"name": "CVE-2024-24549",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24549"
},
{
"name": "CVE-2023-45586",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45586"
},
{
"name": "CVE-2024-23668",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23668"
},
{
"name": "CVE-2023-36640",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36640"
},
{
"name": "CVE-2024-31491",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31491"
},
{
"name": "CVE-2024-23665",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23665"
},
{
"name": "CVE-2024-30255",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30255"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2024-23669",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23669"
}
],
"initial_release_date": "2024-05-15T00:00:00",
"last_revision_date": "2024-05-15T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0404",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-05-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-225 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-225"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-040 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-040"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-282 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-282"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-406 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-406"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-137 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-137"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-222 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-222"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-052 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-052"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-474 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-474"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-195 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-195"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-433 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-433"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-021 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-021"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-420 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-420"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-054 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-054"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-465 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-465"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-415 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-415"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-191 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-191"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-017 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-017"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-120 du 14 mai 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-120"
}
]
}
CERTFR-2024-AVI-0287
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | N/A | FortiClientMac 7.0 versions antérieures à 7.0.11 | ||
| Fortinet | N/A | FortiClientLinux 7.0 versions antérieures à 7.0.11 | ||
| Fortinet | FortiSandbox | FortiSandbox 2.1 toutes versions | ||
| Fortinet | FortiManager | FortiManager 7.2 versions antérieures à 7.2.5 | ||
| Fortinet | FortiSandbox | FortiSandbox 3.1 toutes versions | ||
| Fortinet | FortiManager | FortiManager 7.0 versions antérieures à 7.0.11 | ||
| Fortinet | FortiProxy | FortiProxy 7.2 versions antérieures à 7.2.8 | ||
| Fortinet | FortiSandbox | FortiSandbox 2.2 toutes versions | ||
| Fortinet | FortiOS | FortiOS 7.2 versions antérieures à 7.2.8 | ||
| Fortinet | FortiProxy | FortiProxy 7.4 versions antérieures à 7.4.2 | ||
| Fortinet | FortiSandbox | FortiSandbox 2.4 toutes versions | ||
| Fortinet | FortiOS | FortiOS 6.4 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.1 toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 3.2 toutes versions | ||
| Fortinet | N/A | FortiClientLinux 7.2 versions antérieures à 7.2.1 | ||
| Fortinet | FortiOS | FortiOS 7.4 versions antérieures à 7.4.2 | ||
| Fortinet | FortiSandbox | FortiSandbox 2.3 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.2 toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 4.4 versions antérieures à 4.4.5 | ||
| Fortinet | FortiProxy | FortiProxy 2.0 toutes versions | ||
| Fortinet | N/A | FortiClientMac 7.2 versions antérieures à 7.2.4 | ||
| Fortinet | FortiOS | FortiOS 6.2 versions antérieures à 6.2.16 | ||
| Fortinet | FortiSandbox | FortiSandbox 2.5 toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 4.0 toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 2.0 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.0 toutes versions | ||
| Fortinet | FortiSandbox | FortiSandbox 4.2 versions antérieures à 4.2.7 | ||
| Fortinet | FortiProxy | FortiProxy 7.0 versions antérieures à 7.0.14 | ||
| Fortinet | FortiOS | FortiOS 6.0 toutes versions | ||
| Fortinet | FortiManager | FortiManager 7.4 versions antérieures à 7.4.2 | ||
| Fortinet | FortiNAC | FortiNAC-F 7.2 versions antérieures à 7.2.5 | ||
| Fortinet | FortiSandbox | FortiSandbox 3.0 toutes versions | ||
| Fortinet | FortiOS | FortiOS 7.0 toutes versions |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiClientMac 7.0 versions ant\u00e9rieures \u00e0 7.0.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientLinux 7.0 versions ant\u00e9rieures \u00e0 7.0.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.1 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager 7.2 versions ant\u00e9rieures \u00e0 7.2.5",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 3.1 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager 7.0 versions ant\u00e9rieures \u00e0 7.0.11",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.2 versions ant\u00e9rieures \u00e0 7.2.8",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.2 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.2 versions ant\u00e9rieures \u00e0 7.2.8",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.4 versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.4 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.4 toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.1 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 3.2 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientLinux 7.2 versions ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.4 versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.3 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.2 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 4.4 versions ant\u00e9rieures \u00e0 4.4.5",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 2.0 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientMac 7.2 versions ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.2 versions ant\u00e9rieures \u00e0 6.2.16",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.5 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 4.0 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 2.0 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.0 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 4.2 versions ant\u00e9rieures \u00e0 4.2.7",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.0 versions ant\u00e9rieures \u00e0 7.0.14",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.0 toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager 7.4 versions ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC-F 7.2 versions ant\u00e9rieures \u00e0 7.2.5",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox 3.0 toutes versions",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 7.0 toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-21756",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21756"
},
{
"name": "CVE-2023-47540",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47540"
},
{
"name": "CVE-2023-45590",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45590"
},
{
"name": "CVE-2023-48785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48785"
},
{
"name": "CVE-2023-48784",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48784"
},
{
"name": "CVE-2023-47542",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47542"
},
{
"name": "CVE-2024-31492",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31492"
},
{
"name": "CVE-2024-23671",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23671"
},
{
"name": "CVE-2023-47541",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47541"
},
{
"name": "CVE-2024-26014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26014"
},
{
"name": "CVE-2024-23662",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23662"
},
{
"name": "CVE-2024-31487",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31487"
},
{
"name": "CVE-2023-45588",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45588"
},
{
"name": "CVE-2023-41677",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41677"
},
{
"name": "CVE-2024-21755",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21755"
}
],
"initial_release_date": "2024-04-10T00:00:00",
"last_revision_date": "2024-04-10T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0287",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Fortinet\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire,\u00a0une atteinte \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-060 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-060"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-009 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-009"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-419 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-419"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-454 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-454"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-224 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-224"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-345 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-345"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-416 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-416"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-411 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-411"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-288 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-288"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-413 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-413"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-087 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-087"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-489 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-489"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-493 du 09 avril 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-493"
}
]
}
CERTFR-2024-AVI-0108
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiOS | FortiOS versions 7.4.x antérieures à 7.4.3 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.4.x antérieures à 7.4.3 | ||
| Fortinet | FortiManager | FortiManager versions 7.4.x antérieures à 7.4.2 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | FortiNAC | FortiNAC 8.3, 8.5, 8.6, 8.7, 8.8, 9.1 et 9.2 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.1 toutes versions | ||
| Fortinet | FortiNAC | FortiNAC versions 7.2.x antérieures à 7.2.3 | ||
| Fortinet | FortiOS | FortiOS versions 7.0.x antérieures à 7.0.14 (Cette version reste affectée par la vulnérabilité CVE-2023-47537) | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.4.x antérieures à 7.4.2 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer-BigData versions 7.2.x antérieures à 7.2.6 | ||
| Fortinet | FortiPAM | FortiPAM 1.0 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.2 toutes versions | ||
| Fortinet | FortiOS | FortiOS versions 6.2.x antérieures à 6.2.16 | ||
| Fortinet | FortiManager | FortiManager versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | FortiOS | FortiOS versions 7.2.x antérieures à 7.2.7 | ||
| Fortinet | FortiPAM | FortiPAM 1.2 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy 1.0 toutes versions | ||
| Fortinet | FortiClientEMS | FortiClientEMS versions 7.0.x antérieures à 7.0.11 | ||
| Fortinet | FortiClientEMS | FortiClientEMS versions 7.2.x antérieures à 7.2.3 | ||
| Fortinet | FortiOS | FortiOS 6.0 toutes versions | ||
| Fortinet | FortiWeb | FortiWeb versions 7.4.x antérieures à 7.4.3 | ||
| Fortinet | FortiClientEMS | FortiClientEMS 6.2 et 6.4 toutes versions | ||
| Fortinet | FortiNAC | FortiNAC versions 9.4.x antérieures à 9.4.4 | ||
| Fortinet | FortiProxy | FortiProxy 7.0 toutes versions | ||
| Fortinet | FortiPAM | FortiPAM 1.1 toutes versions | ||
| Fortinet | FortiManager | FortiManager 6.2, 6.4 et 7.0 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy versions 7.2.x antérieures à 7.2.9 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer-BigData 6.2, 6.4 et 7.0 toutes versions | ||
| Fortinet | FortiProxy | FortiProxy versions 2.0.x antérieures à 2.0.14 | ||
| Fortinet | FortiOS | FortiOS versions 6.4.x antérieures à 6.4.15 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer 6.2, 6.4 et 7.0 toutes versions |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiOS versions 7.4.x ant\u00e9rieures \u00e0 7.4.3",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.4.x ant\u00e9rieures \u00e0 7.4.3",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC 8.3, 8.5, 8.6, 8.7, 8.8, 9.1 et 9.2 toutes versions",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.1 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.14 (Cette version reste affect\u00e9e par la vuln\u00e9rabilit\u00e9 CVE-2023-47537)",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer-BigData versions 7.2.x ant\u00e9rieures \u00e0 7.2.6",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM 1.0 toutes versions",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.2 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.16",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.7",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM 1.2 toutes versions",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 1.0 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientEMS versions 7.0.x ant\u00e9rieures \u00e0 7.0.11",
"product": {
"name": "FortiClientEMS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientEMS versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
"product": {
"name": "FortiClientEMS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS 6.0 toutes versions",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 7.4.x ant\u00e9rieures \u00e0 7.4.3",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientEMS 6.2 et 6.4 toutes versions",
"product": {
"name": "FortiClientEMS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.4",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy 7.0 toutes versions",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM 1.1 toutes versions",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager 6.2, 6.4 et 7.0 toutes versions",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.9",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer-BigData 6.2, 6.4 et 7.0 toutes versions",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.14",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.15",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer 6.2, 6.4 et 7.0 toutes versions",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-45581",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45581"
},
{
"name": "CVE-2023-47537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
},
{
"name": "CVE-2024-21762",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
},
{
"name": "CVE-2023-26206",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26206"
},
{
"name": "CVE-2023-44253",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44253"
},
{
"name": "CVE-2024-23113",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
}
],
"initial_release_date": "2024-02-09T00:00:00",
"last_revision_date": "2024-04-10T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0108",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-09T00:00:00.000000"
},
{
"description": "Ajout des syst\u00e8mes affect\u00e9s",
"revision_date": "2024-02-15T00:00:00.000000"
},
{
"description": "Ajout des syst\u00e8mes affect\u00e9s",
"revision_date": "2024-04-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Fortinet\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-268 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-268"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-301 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-301"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-063 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-063"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-357 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-357"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-397 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-397"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-029 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-029"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-015 du 08 f\u00e9vrier 2024",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-015"
}
]
}
CERTFR-2023-AVI-0487
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiNAC versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.8",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 8.3.x \u00e0 9.1.x ant\u00e9rieures \u00e0 9.1.10",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.4",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-33300",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33300"
},
{
"name": "CVE-2023-33299",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33299"
}
],
"initial_release_date": "2023-06-23T00:00:00",
"last_revision_date": "2023-06-23T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0487",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Fortinet\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-096 du 23 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-096"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-074 du 23 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-074"
}
]
}
CERTFR-2023-AVI-0451
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiProxy | FortiProxy versions antérieures à 7.0.10 | ||
| Fortinet | FortiSIEM | FortiSIEM versions antérieures à 7.0.0 | ||
| Fortinet | FortiWeb | FortiWeb versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | N/A | FortiConverter versions 6.x antérieures à 6.2.2 | ||
| Fortinet | FortiManager | FortiManager versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiNAC | FortiNAC versions 8.x à 9.1.x antérieures à 9.1.9 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.4.x antérieures à 6.4.12 | ||
| Fortinet | N/A | FortiADCManager versions 5.x à 7.0.x antérieures à 7.0.1 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.2.x antérieures à 9.2.8 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.4.x antérieures à 9.4.3 | ||
| Fortinet | FortiOS | FortiOS versions 6.x à 7.0.x antérieures à 7.0.12 | ||
| Fortinet | FortiManager | FortiManager versions 6.4.x antérieures à 6.4.12 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | N/A | FortiClientWindows versions 6.4.x antérieures à 6.4.9 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiManager | FortiManager versions 7.0.x antérieures à 7.0.7 | ||
| Fortinet | N/A | FortiConverter versions 7.0.x antérieures à 7.0.1 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.0.x antérieures à 6.0.17 | ||
| Fortinet | FortiNAC | FortiNAC-F versions 7.2.x antérieures à 7.2.1 | ||
| Fortinet | FortiOS | FortiOS versions 7.2.x antérieures à 7.2.5 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.2.x antérieures à 6.2.15 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.x à 7.0.x antérieures à 7.0.7 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.4.x antérieures à 6.4.13 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 7.0.x antérieures à 7.0.12 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.0.x antérieures à 7.0.7 | ||
| Fortinet | FortiADC | FortiADC versions 5.x à 7.1.x antérieures à 7.1.3 | ||
| Fortinet | N/A | FortiClientWindows versions 7.0.x antérieures à 7.0.7 | ||
| Fortinet | FortiADC | FortiADC versions 7.2.x antérieures à 7.2.1 | ||
| Fortinet | N/A | FortiADCManager versions antérieures à 7.1.1 | ||
| Fortinet | FortiPAM | FortiPAM versions antérieures à 1.0.0 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.10",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSIEM versions ant\u00e9rieures \u00e0 7.0.0",
"product": {
"name": "FortiSIEM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiConverter versions 6.x ant\u00e9rieures \u00e0 6.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 8.x \u00e0 9.1.x ant\u00e9rieures \u00e0 9.1.9",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADCManager versions 5.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.8",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.3",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.12",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientWindows versions 6.4.x ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiConverter versions 7.0.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC-F versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.5",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.15",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 5.x \u00e0 7.1.x ant\u00e9rieures \u00e0 7.1.3",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientWindows versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADCManager versions ant\u00e9rieures \u00e0 7.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPAM versions ant\u00e9rieures \u00e0 1.0.0",
"product": {
"name": "FortiPAM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-25609",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25609"
},
{
"name": "CVE-2023-22633",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22633"
},
{
"name": "CVE-2022-39946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39946"
},
{
"name": "CVE-2022-42474",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
},
{
"name": "CVE-2022-42478",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42478"
},
{
"name": "CVE-2022-33877",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33877"
},
{
"name": "CVE-2023-27997",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
},
{
"name": "CVE-2023-26210",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26210"
},
{
"name": "CVE-2023-29181",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
},
{
"name": "CVE-2023-26207",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
},
{
"name": "CVE-2022-43949",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43949"
},
{
"name": "CVE-2023-29179",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
},
{
"name": "CVE-2023-33305",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
},
{
"name": "CVE-2023-29178",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
},
{
"name": "CVE-2022-41327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
},
{
"name": "CVE-2023-26204",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26204"
},
{
"name": "CVE-2023-22639",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
},
{
"name": "CVE-2022-43953",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
},
{
"name": "CVE-2023-28000",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28000"
},
{
"name": "CVE-2023-29175",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
},
{
"name": "CVE-2023-29180",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
}
],
"initial_release_date": "2023-06-13T00:00:00",
"last_revision_date": "2023-06-13T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0451",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-380 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-380"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-076 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-076"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-494 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-494"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-21-141 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-141"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-111 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-111"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-521 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-521"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-229 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-229"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-125 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-125"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-097 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-097"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-107 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-107"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-259 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-259"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-468 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-468"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-258 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-258"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-095 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-095"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-463 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-463"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-119 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-119"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-393 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-393"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-375 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-375"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-455 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-455"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-493 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-493"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-332 du 12 juin 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-332"
}
]
}
CERTFR-2023-AVI-0304
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiADC | FortiADC versions 5.x à 7.0.x antérieures à 7.0.4 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 4.2.x antérieures à 4.2.3 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 3.x antérieures à 3.2.4 | ||
| Fortinet | FortiADC | FortiADC versions 7.1.x antérieures à 7.1.2 | ||
| Fortinet | FortiNAC | FortiNAC versions 8.x à 9.x antérieures à 9.4.2 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 4.0.x antérieures à 4.0.3 | ||
| Fortinet | FortiNAC | FortiNAC-F versions antérieures à 7.2.0 | ||
| Fortinet | FortiWeb | FortiWeb versions antérieures à 6.3.22 | ||
| Fortinet | FortiManager | FortiManager versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiWeb | FortiWeb versions 7.0.x antérieures à 7.0.4 | ||
| Fortinet | FortiManager | FortiManager versions 7.0.x antérieures à 7.0.6 | ||
| Fortinet | FortiDDoS | FortiDDoS-F versions 6.2.x antérieures à 6.2.3 | ||
| Fortinet | FortiOS | FortiOS versions 6.x antérieures à 6.4.13 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiProxy | FortiProxy versions antérieures à 7.0.9 | ||
| Fortinet | FortiOS | FortiOS versions 7.0.x antérieures à 7.0.11 | ||
| Fortinet | FortiDDoS | FortiDDoS-F versions 6.1.x antérieures à 6.1.5 | ||
| Fortinet | FortiDDoS | FortiDDoS-F versions 6.3.x antérieures à 6.3.4 | ||
| Fortinet | FortiDDoS | FortiDDoS-F versions 6.4.x antérieures à 6.4.1 | ||
| Fortinet | N/A | FortiPresence versions antérieures à 2.0.0 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions antérieures à 3.3.3 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.0.x antérieures à 7.0.7 | ||
| Fortinet | FortiSIEM | FortiSIEM versions antérieures à 6.4.1 | ||
| Fortinet | N/A | FortiAuthenticator versions 6.4.x antérieures à 6.4.7 | ||
| Fortinet | N/A | FortiAuthenticator versions 6.1.x à 6.3.x antérieures à 6.3.4 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions 4.1.x antérieures à 4.1.1 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.2.x antérieures à 7.2.3 | ||
| Fortinet | N/A | FortiClientMac versions 6.x à 7.x antérieures à 7.0.8 | ||
| Fortinet | FortiOS | FortiOS versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions 4.0.x antérieures à 4.0.2 | ||
| Fortinet | FortiSOAR | FortiSOAR versions 7.3.x antérieures à 7.3.2 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.4.8 à 6.4.x antérieures à 6.4.11 | ||
| Fortinet | FortiDDoS | FortiDDoS versions 4.x à 5.x antérieures à 5.7.0 | ||
| Fortinet | FortiManager | FortiManager versions 6.4.8 à 6.4.x antérieures à 6.4.11 | ||
| Fortinet | N/A | FortiClientWindows versions 6.x à 7.x antérieures à 7.0.8 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiADC versions 5.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 4.2.x ant\u00e9rieures \u00e0 4.2.3",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 3.x ant\u00e9rieures \u00e0 3.2.4",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 7.1.x ant\u00e9rieures \u00e0 7.1.2",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 8.x \u00e0 9.x ant\u00e9rieures \u00e0 9.4.2",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 4.0.x ant\u00e9rieures \u00e0 4.0.3",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC-F versions ant\u00e9rieures \u00e0 7.2.0",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions ant\u00e9rieures \u00e0 6.3.22",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDDoS-F versions 6.2.x ant\u00e9rieures \u00e0 6.2.3",
"product": {
"name": "FortiDDoS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.x ant\u00e9rieures \u00e0 6.4.13",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.9",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.11",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDDoS-F versions 6.1.x ant\u00e9rieures \u00e0 6.1.5",
"product": {
"name": "FortiDDoS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDDoS-F versions 6.3.x ant\u00e9rieures \u00e0 6.3.4",
"product": {
"name": "FortiDDoS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDDoS-F versions 6.4.x ant\u00e9rieures \u00e0 6.4.1",
"product": {
"name": "FortiDDoS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPresence versions ant\u00e9rieures \u00e0 2.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions ant\u00e9rieures \u00e0 3.3.3",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSIEM versions ant\u00e9rieures \u00e0 6.4.1",
"product": {
"name": "FortiSIEM",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions 6.4.x ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions 6.1.x \u00e0 6.3.x ant\u00e9rieures \u00e0 6.3.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions 4.1.x ant\u00e9rieures \u00e0 4.1.1",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientMac versions 6.x \u00e0 7.x ant\u00e9rieures \u00e0 7.0.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions 4.0.x ant\u00e9rieures \u00e0 4.0.2",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.4.8 \u00e0 6.4.x ant\u00e9rieures \u00e0 6.4.11",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDDoS versions 4.x \u00e0 5.x ant\u00e9rieures \u00e0 5.7.0",
"product": {
"name": "FortiDDoS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 6.4.8 \u00e0 6.4.x ant\u00e9rieures \u00e0 6.4.11",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientWindows versions 6.x \u00e0 7.x ant\u00e9rieures \u00e0 7.0.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35850",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35850"
},
{
"name": "CVE-2022-40679",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40679"
},
{
"name": "CVE-2022-43946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43946"
},
{
"name": "CVE-2022-43952",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43952"
},
{
"name": "CVE-2022-27487",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27487"
},
{
"name": "CVE-2023-27995",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27995"
},
{
"name": "CVE-2023-22641",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
},
{
"name": "CVE-2022-40682",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40682"
},
{
"name": "CVE-2022-43947",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
},
{
"name": "CVE-2022-0847",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0847"
},
{
"name": "CVE-2023-22642",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22642"
},
{
"name": "CVE-2022-27485",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27485"
},
{
"name": "CVE-2022-42469",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
},
{
"name": "CVE-2022-42470",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42470"
},
{
"name": "CVE-2022-43951",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43951"
},
{
"name": "CVE-2022-41331",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41331"
},
{
"name": "CVE-2022-42477",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42477"
},
{
"name": "CVE-2022-41330",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
},
{
"name": "CVE-2022-43948",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43948"
},
{
"name": "CVE-2022-43955",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43955"
},
{
"name": "CVE-2023-22635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22635"
}
],
"initial_release_date": "2023-04-12T00:00:00",
"last_revision_date": "2023-04-12T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0304",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-428 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-428"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-479 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-479"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-502 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-502"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-363 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-363"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-429 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-429"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-186 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-186"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-432 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-432"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-051 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-051"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-056 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-056"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-409 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-409"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-355 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-355"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-060 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-060"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-481 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-481"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-335 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-335"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-050 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-050"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-439 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-439"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-444 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-444"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-320 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-320"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-381 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-381"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-336 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-336"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-275 du 11 avril 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-275"
}
]
}
CERTFR-2023-AVI-0199
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Fortinet. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité, un déni de service à distance, une élévation de privilèges, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiManager | FortiManager versions 6.0.x antérieures à 6.0.5 | ||
| Fortinet | FortiWeb | FortiWeb versions 7.0.x antérieures à 7.0.3 | ||
| Fortinet | FortiSwitch | FortiSwitch versions 7.0.x antérieures à 7.0.5 | ||
| Fortinet | FortiRecorder | FortiRecorder versions antérieures à 7.0.0 | ||
| Fortinet | FortiPortal | FortiPortal versions 6.0.x antérieures à 6.0.10 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.4.x antérieures à 6.4.2 | ||
| Fortinet | FortiMail | FortiMail versions 6.0.x antérieures à 6.0.10 | ||
| Fortinet | FortiSwitch | FortiSwitch versions 6.4.x antérieures à 6.4.11 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.0.x antérieures à 6.0.5 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.2.x antérieures à 9.2.7 | ||
| Fortinet | FortiOS | FortiOS versions antérieures à 7.4.0 | ||
| Fortinet | FortiOS | FortiOS versions 6.2.x antérieures à 6.2.13 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.3.x antérieures à 6.3.21 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.4.x antérieures à 9.4.2 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.2.x antérieures à 6.2.0 | ||
| Fortinet | FortiMail | FortiMail versions 6.2.x antérieures à 6.2.5 | ||
| Fortinet | N/A | FortiAuthenticator versions antérieures à 6.5.0 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiRecorder | FortiRecorder versions 6.4.x antérieures à 6.4.4 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.2.x antérieures à 6.2.13 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.4.x antérieures à 6.4.11 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.0.x antérieures à 7.0.9 | ||
| Fortinet | FortiMail | FortiMail versions 6.4.x antérieures à 6.4.1 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.0.x antérieures à 7.0.6 | ||
| Fortinet | FortiWeb | FortiWeb versions antérieures à 7.2.0 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.4.x antérieures à 6.4.12 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 7.0.x antérieures à 7.0.10 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.2.x antérieures à 7.2.3 | ||
| Fortinet | FortiOS | FortiOS versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | FortiRecorder | FortiRecorder versions 6.0.x antérieures à 6.0.12 | ||
| Fortinet | FortiNAC | FortiNAC versions antérieures à 7.2.0 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions antérieures à 3.2.0 | ||
| Fortinet | FortiManager | FortiManager versions antérieures à 6.2.0 | ||
| Fortinet | FortiSOAR | FortiSOAR versions 7.3.x antérieures à 7.3.2 | ||
| Fortinet | FortiProxy | FortiProxy versions 2.0.x antérieures à 2.0.12 | ||
| Fortinet | FortiOS | FortiOS versions 6.4.x antérieures à 6.4.12 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.1.x antérieures à 9.1.9 | ||
| Fortinet | FortiOS | FortiOS versions 7.0.x antérieures à 7.0.10 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiManager versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions 7.0.x ant\u00e9rieures \u00e0 7.0.5",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiRecorder versions ant\u00e9rieures \u00e0 7.0.0",
"product": {
"name": "FortiRecorder",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPortal versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
"product": {
"name": "FortiPortal",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiMail versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
"product": {
"name": "FortiMail",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.7",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions ant\u00e9rieures \u00e0 7.4.0",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.3.x ant\u00e9rieures \u00e0 6.3.21",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.2",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.2.x ant\u00e9rieures \u00e0 6.2.0",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiMail versions 6.2.x ant\u00e9rieures \u00e0 6.2.5",
"product": {
"name": "FortiMail",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions ant\u00e9rieures \u00e0 6.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiRecorder versions 6.4.x ant\u00e9rieures \u00e0 6.4.4",
"product": {
"name": "FortiRecorder",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.9",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiMail versions 6.4.x ant\u00e9rieures \u00e0 6.4.1",
"product": {
"name": "FortiMail",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions ant\u00e9rieures \u00e0 7.2.0",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiRecorder versions 6.0.x ant\u00e9rieures \u00e0 6.0.12",
"product": {
"name": "FortiRecorder",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions ant\u00e9rieures \u00e0 7.2.0",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions ant\u00e9rieures \u00e0 3.2.0",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions ant\u00e9rieures \u00e0 6.2.0",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSOAR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.12",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.1.x ant\u00e9rieures \u00e0 9.1.9",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-29056",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29056"
},
{
"name": "CVE-2022-41329",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
},
{
"name": "CVE-2022-41328",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
},
{
"name": "CVE-2022-27490",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27490"
},
{
"name": "CVE-2022-41333",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41333"
},
{
"name": "CVE-2023-25611",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25611"
},
{
"name": "CVE-2022-39953",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39953"
},
{
"name": "CVE-2023-23776",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23776"
},
{
"name": "CVE-2022-42476",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
},
{
"name": "CVE-2022-22297",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22297"
},
{
"name": "CVE-2022-39951",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39951"
},
{
"name": "CVE-2022-45861",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
},
{
"name": "CVE-2022-40676",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40676"
},
{
"name": "CVE-2023-25605",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25605"
},
{
"name": "CVE-2023-25610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
}
],
"initial_release_date": "2023-03-08T00:00:00",
"last_revision_date": "2023-03-09T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0199",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-08T00:00:00.000000"
},
{
"description": "Correction mineure dans la partie r\u00e9sum\u00e9",
"revision_date": "2023-03-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eFortinet\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une injection de\ncode indirecte \u00e0 distance (XSS), un contournement de la politique de\ns\u00e9curit\u00e9, un d\u00e9ni de service \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-078 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-078"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-447 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-447"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-488 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-488"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-369 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-369"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-477 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-477"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-254 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-254"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-388 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-388"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-401 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-401"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-050 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-050"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-281 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-281"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-001 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-001"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-218 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-218"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-18-232 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-18-232"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-309 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-309"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-364 du 07 mars 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-364"
}
]
}
CERTFR-2023-AVI-0146
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiWeb | FortiWeb versions 5.x à 7.x antérieures à 7.0.5 | ||
| Fortinet | FortiGate | FortiGate versions antérieures à 6.4.2 | ||
| Fortinet | FortiNAC | FortiNAC-F versions antérieures à 7.2.0 | ||
| Fortinet | FortiPortal | FortiPortal versions 7.0.x antérieures à 7.0.3 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager versions 7.2.x antérieures à 7.2.1 | ||
| Fortinet | FortiOS | FortiOS versions 6.0.x à 7.0.x antérieures à 7.0.9 | ||
| Fortinet | FortiADC | FortiADC versions 5.x à 6.2.x antérieures à 6.2.4 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.0.x antérieures à 7.0.5 | ||
| Fortinet | N/A | FortiAuthenticator versions 6.1.x antérieures à 6.1.1 | ||
| Fortinet | N/A | FortiExtender versions 3.3.x antérieures à 3.3.3 | ||
| Fortinet | N/A | FortiExtender versions 5.3.x antérieures à 7.0.4 | ||
| Fortinet | FortiNAC | FortiNAC versions 8.x à 9.4.x antérieures à 9.4.2 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 3.2.x à 4.x antérieures à 4.2.0 | ||
| Fortinet | FortiADC | FortiADC versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.2.x antérieures à 7.2.2 | ||
| Fortinet | N/A | FortiExtender versions 3.x antérieures à 3.2.4 | ||
| Fortinet | N/A | FortiExtender versions 4.2.x antérieures à 4.2.5 (version à venir) | ||
| Fortinet | FortiSwitch | FortiSwitch versions 7.0.x antérieures à 7.0.4 | ||
| Fortinet | FortiWAN | FortiWAN versions 4.x antérieures à 4.5.10 | ||
| Fortinet | N/A | FortiExtender versions 4.1.x antérieures à 4.1.9 (version à venir) | ||
| Fortinet | FortiSwitch | FortiSwitch versions 6.x antérieures à 6.4.11 | ||
| Fortinet | FortiADC | FortiADC 5.1 all versions | ||
| Fortinet | FortiADC | FortiADC 5.0 all versions | ||
| Fortinet | N/A | FortiExtender versions 4.0.x antérieures à 4.0.3 (version à venir) | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.x antérieures à 6.4.9 | ||
| Fortinet | FortiProxy | FortiProxy versions 1.x à 7.0.x antérieures à 7.0.8 | ||
| Fortinet | FortiOS | FortiOS versions 7.2.x antérieures à 7.2.4 | ||
| Fortinet | N/A | FortiAuthenticator versions 5.x à 6.0.x antérieures à 6.0.5 | ||
| Fortinet | FortiSwitchManager | FortiSwitchManager versions 7.0.x antérieures à 7.0.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiWeb versions 5.x \u00e0 7.x ant\u00e9rieures \u00e0 7.0.5",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiGate versions ant\u00e9rieures \u00e0 6.4.2",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC-F versions ant\u00e9rieures \u00e0 7.2.0",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiPortal versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiPortal",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.0.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.9",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 5.x \u00e0 6.2.x ant\u00e9rieures \u00e0 6.2.4",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.5",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions 6.1.x ant\u00e9rieures \u00e0 6.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 3.3.x ant\u00e9rieures \u00e0 3.3.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 5.3.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 8.x \u00e0 9.4.x ant\u00e9rieures \u00e0 9.4.2",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 3.2.x \u00e0 4.x ant\u00e9rieures \u00e0 4.2.0",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 3.x ant\u00e9rieures \u00e0 3.2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 4.2.x ant\u00e9rieures \u00e0 4.2.5 (version \u00e0 venir)",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWAN versions 4.x ant\u00e9rieures \u00e0 4.5.10",
"product": {
"name": "FortiWAN",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 4.1.x ant\u00e9rieures \u00e0 4.1.9 (version \u00e0 venir)",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions 6.x ant\u00e9rieures \u00e0 6.4.11",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 5.1 all versions",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC 5.0 all versions",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiExtender versions 4.0.x ant\u00e9rieures \u00e0 4.0.3 (version \u00e0 venir)",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.x ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 1.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.8",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions 5.x \u00e0 6.0.x ant\u00e9rieures \u00e0 6.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitchManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "FortiSwitchManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-30304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30304"
},
{
"name": "CVE-2021-42756",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42756"
},
{
"name": "CVE-2023-23780",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23780"
},
{
"name": "CVE-2022-40678",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40678"
},
{
"name": "CVE-2022-40677",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40677"
},
{
"name": "CVE-2022-33869",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33869"
},
{
"name": "CVE-2022-30303",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30303"
},
{
"name": "CVE-2022-26115",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26115"
},
{
"name": "CVE-2023-22638",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22638"
},
{
"name": "CVE-2022-42472",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42472"
},
{
"name": "CVE-2022-39948",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
},
{
"name": "CVE-2022-41335",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41335"
},
{
"name": "CVE-2022-38378",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38378"
},
{
"name": "CVE-2022-30306",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30306"
},
{
"name": "CVE-2023-23782",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23782"
},
{
"name": "CVE-2021-43074",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43074"
},
{
"name": "CVE-2023-23778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23778"
},
{
"name": "CVE-2023-25602",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25602"
},
{
"name": "CVE-2022-22302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22302"
},
{
"name": "CVE-2022-27489",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27489"
},
{
"name": "CVE-2022-43954",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43954"
},
{
"name": "CVE-2022-30299",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30299"
},
{
"name": "CVE-2022-30300",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30300"
},
{
"name": "CVE-2022-38375",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38375"
},
{
"name": "CVE-2022-29054",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29054"
},
{
"name": "CVE-2022-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33871"
},
{
"name": "CVE-2022-39952",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39952"
},
{
"name": "CVE-2023-22636",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22636"
},
{
"name": "CVE-2022-40683",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40683"
},
{
"name": "CVE-2023-23777",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23777"
},
{
"name": "CVE-2023-23779",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23779"
},
{
"name": "CVE-2023-23784",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23784"
},
{
"name": "CVE-2022-38376",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38376"
},
{
"name": "CVE-2021-42761",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42761"
},
{
"name": "CVE-2022-39954",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39954"
},
{
"name": "CVE-2022-40675",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40675"
},
{
"name": "CVE-2023-23783",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23783"
},
{
"name": "CVE-2022-27482",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27482"
},
{
"name": "CVE-2023-23781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23781"
}
],
"initial_release_date": "2023-02-17T00:00:00",
"last_revision_date": "2023-02-17T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-273"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-329"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-157"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-080"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-133"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-166"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-187"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-167"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-111"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-430"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-260"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-280"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-300"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-460"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-304"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-046"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-362"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-164"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-346"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-151"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-391"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-220"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-214"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-118"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-312"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-131"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-163"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-234"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-186"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-014"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-224"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-048"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-257"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-251"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-348"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-265"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-136"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-146"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet du 16 f\u00e9vrier 2023",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-142"
}
],
"reference": "CERTFR-2023-AVI-0146",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-17T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Fortinet\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et une atteinte\n\u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-166 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-460 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-046 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-280 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-273 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-251 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-312 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-014 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-362 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-300 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-214 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-391 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-164 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-430 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-146 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-131 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-157 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-265 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-234 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-118 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-348 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-187 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-220 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-260 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-167 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-151 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-346 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-111 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-080 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-133 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-304 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-329 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-142 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-163 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-048 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-186 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-257 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-126 du 16 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-136 du 16 f\u00e9vrier 2023",
"url": null
}
]
}
CERTFR-2022-AVI-613
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiOS | FortiOS versions 6.x antérieures à 6.2.11 | ||
| Fortinet | FortiEDR Central Manager | FortiEDR Central Manager versions 5.1.x antérieures à 5.2.0 | ||
| Fortinet | FortiManager | FortiManager versions 7.0.x antérieures à 7.0.4 | ||
| Fortinet | FortiSwitch | FortiSwitch versions 7.0.x antérieures à 7.0.3 | ||
| Fortinet | FortiNAC | FortiNAC versions antérieures à 9.1.6 | ||
| Fortinet | FortiManager | FortiManager versions 6.x antérieures à 6.4.8 | ||
| Fortinet | FortiEDR Central Manager | FortiEDR Central Manager version 5.1.0 | ||
| Fortinet | N/A | FortiClientWindows versions 7.0.x antérieures à 7.0.3 | ||
| Fortinet | FortiRecorder | FortiRecorder versions antérieures à 6.0.11 | ||
| Fortinet | FortiEDR Central Manager | FortiEDR Central Manager versions 5.0.x antérieures à 5.0.3 Patch 7 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.0.x antérieures à 7.0.1 | ||
| Fortinet | FortiRecorder | FortiRecorder versions antérieures à 6.4.3 | ||
| Fortinet | FortiADC | FortiADC versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiADC | FortiADC versions antérieures à 6.2.3 | ||
| Fortinet | FortiOS | FortiOS versions 7.0.x antérieures à 7.0.6 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 7.0.x antérieures à 7.0.4 | ||
| Fortinet | N/A | FortiVoiceEnterprise versions 6.4.x antérieures à 6.4.4 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions antérieures à 3.3.3 | ||
| Fortinet | FortiSwitch | FortiSwitch versions antérieures à 6.4.10 | ||
| Fortinet | N/A | FortiClientWindows versions 6.x antérieures à 6.4.7 | ||
| Fortinet | FortiOS | FortiOS versions 6.4.x antérieures à 6.4.9 | ||
| Fortinet | N/A | FortiVoiceEnterprise versions antérieures à 6.0.11 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.2.x antérieures à 9.2.4 | ||
| Fortinet | FortiProxy | FortiProxy versions antérieures à 2.0.9 | ||
| Fortinet | FortiDeceptor | FortiDeceptor versions 4.0.x antérieures à 4.0.2 | ||
| Fortinet | FortiGate | FortiGate versions antérieures à 7.0.6 | ||
| Fortinet | FortiAnalyzer | FortiAnalyzer versions 6.x antérieures à 6.4.8 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiOS versions 6.x ant\u00e9rieures \u00e0 6.2.11",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiEDR Central Manager versions 5.1.x ant\u00e9rieures \u00e0 5.2.0",
"product": {
"name": "FortiEDR Central Manager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions ant\u00e9rieures \u00e0 9.1.6",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiManager versions 6.x ant\u00e9rieures \u00e0 6.4.8",
"product": {
"name": "FortiManager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiEDR Central Manager version 5.1.0",
"product": {
"name": "FortiEDR Central Manager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientWindows versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiRecorder versions ant\u00e9rieures \u00e0 6.0.11",
"product": {
"name": "FortiRecorder",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiEDR Central Manager versions 5.0.x ant\u00e9rieures \u00e0 5.0.3 Patch 7",
"product": {
"name": "FortiEDR Central Manager",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiRecorder versions ant\u00e9rieures \u00e0 6.4.3",
"product": {
"name": "FortiRecorder",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions ant\u00e9rieures \u00e0 6.2.3",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiVoiceEnterprise versions 6.4.x ant\u00e9rieures \u00e0 6.4.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions ant\u00e9rieures \u00e0 3.3.3",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSwitch versions ant\u00e9rieures \u00e0 6.4.10",
"product": {
"name": "FortiSwitch",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientWindows versions 6.x ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiVoiceEnterprise versions ant\u00e9rieures \u00e0 6.0.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.4",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions ant\u00e9rieures \u00e0 2.0.9",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiDeceptor versions 4.0.x ant\u00e9rieures \u00e0 4.0.2",
"product": {
"name": "FortiDeceptor",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiGate versions ant\u00e9rieures \u00e0 7.0.6",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAnalyzer versions 6.x ant\u00e9rieures \u00e0 6.4.8",
"product": {
"name": "FortiAnalyzer",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-42755",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42755"
},
{
"name": "CVE-2021-44170",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44170"
},
{
"name": "CVE-2021-43072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43072"
},
{
"name": "CVE-2022-26117",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26117"
},
{
"name": "CVE-2022-30302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30302"
},
{
"name": "CVE-2022-29057",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29057"
},
{
"name": "CVE-2022-26118",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26118"
},
{
"name": "CVE-2022-27483",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27483"
},
{
"name": "CVE-2021-41031",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41031"
},
{
"name": "CVE-2022-26120",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26120"
},
{
"name": "CVE-2022-23438",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23438"
}
],
"initial_release_date": "2022-07-06T00:00:00",
"last_revision_date": "2022-07-06T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-613",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-155 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-155"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-051 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-051"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-057 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-057"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-056 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-056"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-213 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-213"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-190 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-190"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-179 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-179"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-058 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-058"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-049 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-049"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-077 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-077"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-206 du 05 juillet 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-206"
}
]
}
CERTFR-2022-AVI-410
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiNAC | Fortinet FortiNAC versions 9.2.x antérieures à 9.2.3 | ||
| Fortinet | FortiNAC | Fortinet FortiNAC versions 9.4.x antérieures à 9.4.0 | ||
| Fortinet | FortiGate | Fortinet FortiGate versions 7.0.x antérieures à 7.0.4 | ||
| Fortinet | N/A | Fortinet FortiIsolator versions antérieures à 2.3.3 ou 2.4.0 | ||
| Fortinet | FortiProxy | Fortinet FortiProxy versions 2.0.x antérieures à 2.0.8 | ||
| Fortinet | FortiClient | Fortinet FortiClient versions antérieures à 6.4.7 | ||
| Fortinet | FortiSOAR | Fortinet FortiSOAR versions antérieures à 7.2.0 | ||
| Fortinet | FortiProxy | Fortinet FortiProxy versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiClient | Fortinet FortiClient versions 7.x antérieures à 7.0.3 | ||
| Fortinet | N/A | Fortinet FortiFone versions antérieures à 3.0.12 | ||
| Fortinet | FortiGate | Fortinet FortiGate versions antérieures à 6.4.9 | ||
| Fortinet | FortiNAC | Fortinet FortiNAC versions 10.x antérieures à 10.0.0 | ||
| Fortinet | FortiOS | Fortinet FortiOS versions antérieures à 6.4.9 | ||
| Fortinet | FortiNAC | Fortinet FortiNAC versions antérieures à 9.1.6 | ||
| Fortinet | FortiOS | Fortinet FortiOS versions 7.0.x antérieures à 7.0.4 ou 7.2.0 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Fortinet FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.3",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiGate versions 7.0.x ant\u00e9rieures \u00e0 7.0.4",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiIsolator versions ant\u00e9rieures \u00e0 2.3.3 ou 2.4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.8",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiClient versions ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "FortiClient",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiSOAR versions ant\u00e9rieures \u00e0 7.2.0",
"product": {
"name": "FortiSOAR",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiClient versions 7.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiClient",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiFone versions ant\u00e9rieures \u00e0 3.0.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiGate versions ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiNAC versions 10.x ant\u00e9rieures \u00e0 10.0.0",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiOS versions ant\u00e9rieures \u00e0 6.4.9",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiNAC versions ant\u00e9rieures \u00e0 9.1.6",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Fortinet FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.4 ou 7.2.0",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-43845",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43845"
},
{
"name": "CVE-2021-21375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21375"
},
{
"name": "CVE-2020-15260",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15260"
},
{
"name": "CVE-2021-37706",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37706"
},
{
"name": "CVE-2022-26116",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26116"
},
{
"name": "CVE-2021-43081",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43081"
},
{
"name": "CVE-2022-23443",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23443"
},
{
"name": "CVE-2021-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43804"
},
{
"name": "CVE-2021-43066",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43066"
},
{
"name": "CVE-2021-32686",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32686"
},
{
"name": "CVE-2022-22306",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22306"
},
{
"name": "CVE-2021-41020",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41020"
},
{
"name": "CVE-2021-43206",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43206"
},
{
"name": "CVE-2021-41032",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41032"
}
],
"initial_release_date": "2022-05-04T00:00:00",
"last_revision_date": "2022-05-04T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-410",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-05-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-062 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-062"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-231 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-231"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-041 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-041"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-147 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-147"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-040 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-040"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-230 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-230"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-239 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-239"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-154 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-154"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-007 du 03 mai 2022",
"url": "https://www.fortiguard.com/psirt/FG-IR-22-007"
}
]
}
CERTFR-2021-AVI-927
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiGate | FortiGate versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiClient | FortiClient pour Linux, Mac et Windows versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiGate | FortiGate versions 6.4.x antérieures à 6.4.7 | ||
| Fortinet | FortiProxy | FortiProxy versions 1.x antérieures à 1.2.12 | ||
| Fortinet | FortiOS | FortiOS versions 6.2.x antérieures à 6.2.10 | ||
| Fortinet | FortiNAC | FortiNAC versions 8.8.x antérieures à 8.8.10 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.4.x antérieures à 6.4.2 | ||
| Fortinet | FortiOS | FortiOS versions 7.0.x antérieures à 7.0.3 | ||
| Fortinet | FortiADC | FortiADC versions 6.1.x antérieures à 6.1.4 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.2.x antérieures à 6.2.6 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 3.x antérieures à 3.2.3 | ||
| Fortinet | FortiGate | FortiGate versions 6.2.x antérieures à 6.2.10 | ||
| Fortinet | FortiOS | FortiOS versions 5.6.x antérieures à 5.6.14 | ||
| Fortinet | FortiOS | FortiOS versions 6.4.x antérieures à 6.4.8 | ||
| Fortinet | FortiOS | FortiOS versions 6.0.x antérieures à 6.0.14 | ||
| Fortinet | FortiADC | FortiADC version 6.2.x antérieures à 6.2.1 | ||
| Fortinet | FortiClient | FortiClient pour Linux, Mac et Windows versions 6.4.x antérieures à 6.4.7 | ||
| Fortinet | FortiProxy | FortiProxy versions 2.x antérieures à 2.0.4 | ||
| Fortinet | FortiWeb | FortiWeb versions 6.3.x antérieures à 6.3.16 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.4.x antérieures à 6.4.3 | ||
| Fortinet | FortiSandbox | FortiSandbox versions 4.x antérieures à 4.0.1 | ||
| Fortinet | FortiClientEMS | FortiClientEMS versions 7.0.x antérieures à 7.0.2 | ||
| Fortinet | FortiClientEMS | FortiClientEMS versions 6.4.x antérieures à 6.4.7 | ||
| Fortinet | N/A | Meru AP versions antérieures à 8.6.2 | ||
| Fortinet | FortiProxy | FortiProxy versions 7.x antérieures à 7.0.1 | ||
| Fortinet | N/A | FortiWLC versions antérieures à 8.6.2 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.2.x antérieures à 9.2.1 | ||
| Fortinet | FortiNAC | FortiNAC versions 9.1.x antérieures à 9.1.4 | ||
| Fortinet | N/A | FortiAuthenticator versions antérieures à 6.4.1 | ||
| Fortinet | FortiOS | FortiOS-6K7K versions 6.2.x antérieures à 6.2.8 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiGate versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClient pour Linux, Mac et Windows versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiClient",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiGate versions 6.4.x ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 1.x ant\u00e9rieures \u00e0 1.2.12",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.10",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 8.8.x ant\u00e9rieures \u00e0 8.8.10",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC versions 6.1.x ant\u00e9rieures \u00e0 6.1.4",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.2.x ant\u00e9rieures \u00e0 6.2.6",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 3.x ant\u00e9rieures \u00e0 3.2.3",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiGate versions 6.2.x ant\u00e9rieures \u00e0 6.2.10",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 5.6.x ant\u00e9rieures \u00e0 5.6.14",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.8",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS versions 6.0.x ant\u00e9rieures \u00e0 6.0.14",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiADC version 6.2.x ant\u00e9rieures \u00e0 6.2.1",
"product": {
"name": "FortiADC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClient pour Linux, Mac et Windows versions 6.4.x ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "FortiClient",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 2.x ant\u00e9rieures \u00e0 2.0.4",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWeb versions 6.3.x ant\u00e9rieures \u00e0 6.3.16",
"product": {
"name": "FortiWeb",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.3",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiSandbox versions 4.x ant\u00e9rieures \u00e0 4.0.1",
"product": {
"name": "FortiSandbox",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientEMS versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
"product": {
"name": "FortiClientEMS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiClientEMS versions 6.4.x ant\u00e9rieures \u00e0 6.4.7",
"product": {
"name": "FortiClientEMS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Meru AP versions ant\u00e9rieures \u00e0 8.6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions 7.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiWLC versions ant\u00e9rieures \u00e0 8.6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.1",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions 9.1.x ant\u00e9rieures \u00e0 9.1.4",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAuthenticator versions ant\u00e9rieures \u00e0 6.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.8",
"product": {
"name": "FortiOS",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-43068",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43068"
},
{
"name": "CVE-2021-44168",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44168"
},
{
"name": "CVE-2021-36194",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36194"
},
{
"name": "CVE-2021-41028",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41028"
},
{
"name": "CVE-2021-36195",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36195"
},
{
"name": "CVE-2021-41014",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41014"
},
{
"name": "CVE-2021-41030",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41030"
},
{
"name": "CVE-2021-43067",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43067"
},
{
"name": "CVE-2021-41017",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41017"
},
{
"name": "CVE-2021-43064",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43064"
},
{
"name": "CVE-2021-41021",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41021"
},
{
"name": "CVE-2021-42759",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42759"
},
{
"name": "CVE-2021-43071",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43071"
},
{
"name": "CVE-2021-36173",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36173"
},
{
"name": "CVE-2021-41024",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41024"
},
{
"name": "CVE-2021-42752",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42752"
},
{
"name": "CVE-2021-41025",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41025"
},
{
"name": "CVE-2021-41015",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41015"
},
{
"name": "CVE-2021-43065",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43065"
},
{
"name": "CVE-2021-26110",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26110"
},
{
"name": "CVE-2021-41013",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41013"
},
{
"name": "CVE-2021-26108",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26108"
},
{
"name": "CVE-2021-43204",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43204"
},
{
"name": "CVE-2021-42758",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42758"
},
{
"name": "CVE-2021-41029",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41029"
},
{
"name": "CVE-2021-42760",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42760"
},
{
"name": "CVE-2021-41026",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41026"
},
{
"name": "CVE-2021-41027",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41027"
},
{
"name": "CVE-2021-36189",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36189"
},
{
"name": "CVE-2021-36180",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36180"
},
{
"name": "CVE-2021-36191",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36191"
},
{
"name": "CVE-2021-42757",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42757"
},
{
"name": "CVE-2021-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32591"
},
{
"name": "CVE-2021-36190",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36190"
},
{
"name": "CVE-2021-26109",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26109"
},
{
"name": "CVE-2021-26103",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26103"
},
{
"name": "CVE-2021-36167",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36167"
},
{
"name": "CVE-2021-43063",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43063"
},
{
"name": "CVE-2021-36188",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36188"
}
],
"initial_release_date": "2021-12-08T00:00:00",
"last_revision_date": "2021-12-08T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-927",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-12-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-201 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-201"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-130 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-130"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-134 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-134"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-049 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-049"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-075 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-075"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-122 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-122"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-140 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-140"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-051 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-051"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-192 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-192"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-138 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-138"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-152 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-152"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-127 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-127"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-120 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-120"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-222 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-222"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-118 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-118"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-212 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-212"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-133 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-133"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-131 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-131"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-173 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-173"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-182 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-182"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-114 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-114"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-111 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-111"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-115 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-115"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-123 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-123"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-181 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-181"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-160 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-160"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-129 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-129"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-200 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-200"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-167 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-167"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-157 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-157"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-139 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-139"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-168 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-168"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-156 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-156"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-188 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-188"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-158 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-158"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-178 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-178"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-131 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-131"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-004 du 8 d\u00e9cembre 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-004"
}
]
}
CERTFR-2021-AVI-343
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, une élévation de privilèges et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Fortinet | FortiProxy | FortiProxy versions 2.x antérieures à 2.0.1 | ||
| Fortinet | N/A | Meru AP versions antérieures à 8.5.3 | ||
| Fortinet | FortiNAC | FortiNAC versions antérieures à 8.8.2 | ||
| Fortinet | N/A | FortiAI versions antérieures à 1.5.0 | ||
| Fortinet | FortiProxy | FortiProxy versions antérieures à 1.2.10 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiProxy versions 2.x ant\u00e9rieures \u00e0 2.0.1",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "Meru AP versions ant\u00e9rieures \u00e0 8.5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions ant\u00e9rieures \u00e0 8.8.2",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiAI versions ant\u00e9rieures \u00e0 1.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiProxy versions ant\u00e9rieures \u00e0 1.2.10",
"product": {
"name": "FortiProxy",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-15706",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15706"
},
{
"name": "CVE-2021-24023",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24023"
},
{
"name": "CVE-2021-24011",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24011"
},
{
"name": "CVE-2021-22126",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22126"
}
],
"initial_release_date": "2021-05-05T00:00:00",
"last_revision_date": "2023-12-20T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-343",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-05-05T00:00:00.000000"
},
{
"description": "Correction coquille.",
"revision_date": "2023-12-20T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Elles permettent \u00e0 un attaquant de provoquer un contournement\nde la politique de s\u00e9curit\u00e9, une \u00e9l\u00e9vation de privil\u00e8ges et une\ninjection de code indirecte \u00e0 distance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-033 du 03 mai 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-21-033"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-226 du 03 mai 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-226"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-038 du 03 mai 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-038"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-147 du 03 mai 2021",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-147"
}
]
}
CERTFR-2020-AVI-595
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiGate 6.2.x toutes versions",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiGate 6.4.x versions ant\u00e9rieures \u00e0 6.4.1",
"product": {
"name": "FortiGate",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions ant\u00e9rieures \u00e0 8.7.3",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-12818",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12818"
},
{
"name": "CVE-2020-12816",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12816"
}
],
"initial_release_date": "2020-09-24T00:00:00",
"last_revision_date": "2020-09-24T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-595",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-09-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Elles permettent \u00e0 un attaquant de provoquer un contournement\nde la politique de s\u00e9curit\u00e9 et une injection de code indirecte \u00e0\ndistance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-033 du 23 septembre 2020",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-033"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-002 du 23 septembre 2020",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-002"
}
]
}
CERTFR-2019-AVI-338
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans Fortinet FortiNAC. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FortiNAC versions 8.5.x ant\u00e9rieures \u00e0 8.5.1",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
},
{
"description": "FortiNAC versions ant\u00e9rieures \u00e0 8.3.7",
"product": {
"name": "FortiNAC",
"vendor": {
"name": "Fortinet",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-5594",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5594"
}
],
"initial_release_date": "2019-07-17T00:00:00",
"last_revision_date": "2019-07-17T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-338",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-07-17T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Fortinet FortiNAC. Elle permet \u00e0\nun attaquant de provoquer une injection de code indirecte \u00e0 distance\n(XSS).\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Fortinet FortiNAC",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-19-140 du 16 juillet 2019",
"url": "https://fortiguard.com/psirt/FG-IR-19-140"
}
]
}