SQL Injection Vulnerability in Fortinet's FortiNAC Product
CVE-2022-26116

7.2HIGH

Key Information:

Vendor

Fortinet
Status
Fortinet Fortinac
Vendor
CVE Published:
11 May 2022

What is CVE-2022-26116?

An SQL Injection vulnerability exists in FortiNAC that allows authenticated attackers to execute unauthorized commands through specially crafted string parameters. This vulnerability arises from the improper neutralization of special elements used in SQL commands, potentially leading to severe security breaches. Affected versions include FortiNAC 8.3.7 and below, several versions in the 8.5, 8.6, 8.7, 8.8, and 9.1 series, making it essential for administrators to evaluate their current installations and apply necessary updates.

Affected Version(s)

Fortinet FortiNAC FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below.

References

https://fortiguard.com/psirt/FG-IR-22-062
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.