Sign-up

ID

VAR-202211-0189


CVE

CVE-2022-35842


TITLE

fortinet's  FortiOS  Vulnerability regarding information leakage in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022810

DESCRIPTION

An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS. fortinet's FortiOS There is a vulnerability related to information leakage.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2022-35842 // JVNDB: JVNDB-2022-022810 // VULHUB: VHN-432093

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiosscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiosscope:eqversion:7.2.0

Trust: 1.0

vendor:fortinetmodel:fortiosscope:gteversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:fortiosscope:lteversion:6.4.9

Trust: 1.0

vendor:fortinetmodel:fortiosscope:lteversion:7.0.6

Trust: 1.0

vendor:フォーティネットmodel:fortiosscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiosscope:eqversion:7.0.0 to 7.0.6

Trust: 0.8

vendor:フォーティネットmodel:fortiosscope:eqversion:6.4.0 to 6.4.9

Trust: 0.8

vendor:フォーティネットmodel:fortiosscope:eqversion:7.2.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022810 // NVD: CVE-2022-35842

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-35842
value: HIGH

Trust: 1.8

psirt@fortinet.com: CVE-2022-35842
value: LOW

Trust: 1.0

CNNVD: CNNVD-202211-1894
value: HIGH

Trust: 0.6

NVD:
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

psirt@fortinet.com:
baseSeverity: LOW
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-35842
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022810 // NVD: CVE-2022-35842 // NVD: CVE-2022-35842 // CNNVD: CNNVD-202211-1894

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.0

problemtype:information leak (CWE-200) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022810 // NVD: CVE-2022-35842

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202211-1894

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202211-1894

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-35842

PATCH
title:FG-IR-22-223url:https://fortiguard.com/psirt/fg-ir-22-223
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2022-022810

EXTERNAL IDS
db:NVDid:CVE-2022-35842
Trust: 3.3
db:JVNDBid:JVNDB-2022-022810
Trust: 0.8
db:CNNVDid:CNNVD-202211-1894
Trust: 0.6
db:VULHUBid:VHN-432093
Trust: 0.1
sources:
            
            
            VULHUB: VHN-432093 // 
            
            
            
            JVNDB: JVNDB-2022-022810 // 
            
            
            
            NVD: CVE-2022-35842 // 
            
            
            
            CNNVD: CNNVD-202211-1894

REFERENCES
url:https://fortiguard.com/psirt/fg-ir-22-223
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2022-35842
Trust: 0.8
url:https://vigilance.fr/vulnerability/fortinet-fortios-information-disclosure-via-ssl-vpn-interface-telnet-39801
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-35842/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-432093 // 
            
            
            
            JVNDB: JVNDB-2022-022810 // 
            
            
            
            NVD: CVE-2022-35842 // 
            
            
            
            CNNVD: CNNVD-202211-1894

SOURCES
db:VULHUBid:VHN-432093
db:JVNDBid:JVNDB-2022-022810
db:NVDid:CVE-2022-35842
db:CNNVDid:CNNVD-202211-1894

LAST UPDATE DATE
2023-12-18T13:06:27.314000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-432093date:2022-11-04T00:00:00
db:JVNDBid:JVNDB-2022-022810date:2023-11-21T01:18:00
db:NVDid:CVE-2022-35842date:2023-08-08T14:21:49.707
db:CNNVDid:CNNVD-202211-1894date:2022-11-07T00:00:00

SOURCES RELEASE DATE
db:VULHUBid:VHN-432093date:2022-11-02T00:00:00
db:JVNDBid:JVNDB-2022-022810date:2023-11-21T00:00:00
db:NVDid:CVE-2022-35842date:2022-11-02T12:15:53.377
db:CNNVDid:CNNVD-202211-1894date:2022-11-01T00:00:00