Improper XML External Entity Handling in Fortinet FortiNAC

CVE-2022-39954

What is CVE-2022-39954?

Fortinet FortiNAC is susceptible to an improper restriction of XML external entity references, impacting various versions. This vulnerability enables attackers to exploit crafted XML documents to either read arbitrary files from the affected server or induce a denial of service. The flaw exists across multiple versions, affecting user environments where FortiNAC is deployed, thereby opening avenues for potential data breaches and service interruptions.

References