Fortinet Fixes Six Serious Vulnerabilities

Including six vulnerabilities with a high severity rating, Fortinet warned customers on Tuesday (1 November) of 16 vulnerabilities found in the company’s devices. 

Improper neutralization of input during web page generation vulnerability (CVE-2022-35842) in FortiADC is one of the high-severity flaws that may allow a remote, unauthenticated attacker to carry out a stored cross-site scripting (XSS) attack using HTTP fields seen in the traffic and event logviews. 

A local attacker can directly access the Glassfish server with command-line access using a hardcoded password in FortiSIEM due to a vulnerability.

Cross-site scripting (XSS) vulnerabilities are the remaining critical flaws that can have a high impact. FortiADC, FortiDeceptor, FortiManager, and FortiAnalyzer are all affected. Threat actors can remotely exploit them without needing authentication.

Patches for FortiOS, FortiTester, FortiSOAR, FortiMail, FortiEDR CollectorWindows, FortiClient for Mac, and FortiADC have been released that address medium and low-severity vulnerabilities. 

These security flaws can be used for privilege escalation, executing arbitrary commands, bypassing security measures, gathering sensitive data, DoS attacks, and more. 

You can find further details on the advisory released by Fortinet.

Another critical vulnerability coded CVE-2022-40684 emerged in October. You can read our detailed blog post about the issue.

Complete List of Fortinet Vulnerabilities