Vulnerabilities > CVE-2022-45857 - Unspecified vulnerability in Fortinet Fortimanager

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

HIGH

network

high complexity

fortinet

NVD

Published: 2023-01-05

Updated: 2023-11-07

Summary

An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortimanager 6.4.1 Fortinet Fortimanager 6.4.2 Fortinet Fortimanager 6.4.3 Fortinet Fortimanager 7.0.0 Fortinet Fortimanager 7.0.1 Fortinet Fortimanager 6.2.0 Fortinet Fortimanager 6.2.1 Fortinet Fortimanager 6.2.2 Fortinet Fortimanager 6.2.3 Fortinet Fortimanager 6.2.4 Fortinet Fortimanager 6.2.5 Fortinet Fortimanager 6.2.6 Fortinet Fortimanager 6.2.7 Fortinet Fortimanager 6.2.8	15

References

https://fortiguard.com/psirt/FG-IR-22-371