CVE-2022-23443
HIGHCVSS 7.5/10EPSS 1.18%
Last modified
CVE-2022-23443 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.. EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortisoar | >= 6.4.0, <= 6.4.4 |
| Fortinet | Fortisoar | >= 7.0.0, <= 7.0.2 |
| Fortinet | Fortisoar | 6.0.0 |
References
- https://fortiguard.com/psirt/FG-IR-22-041Vendor Advisory
- https://fortiguard.com/psirt/FG-IR-22-041Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23443?
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.
How severe is CVE-2022-23443?
CVE-2022-23443 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.18% probability of exploitation in the next 30 days.
How do I fix CVE-2022-23443?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23438An improper neutralization of input during web page generati…6.1
- CVE-2022-23439A externally controlled reference to a resource in another s…6.1
- CVE-2022-2344Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
- CVE-2022-23440A use of hard-coded cryptographic key vulnerability [CWE-321…7.8
- CVE-2022-23441A use of hard-coded cryptographic key vulnerability [CWE-321…9.1
- CVE-2022-23442An improper access control vulnerability [CWE-284] in FortiO…4.3
- CVE-2022-23446A improper control of a resource through its lifetime in For…4.4
- CVE-2022-23447An improper limitation of a pathname to a restricted directo…7.5
- CVE-2022-23448A vulnerability has been identified in SIMATIC Energy Manage…7.8
- CVE-2022-23449A vulnerability has been identified in SIMATIC Energy Manage…7.3
- CVE-2022-2345Use After Free in GitHub repository vim/vim prior to 9.0.004…7.8
- CVE-2022-23450A vulnerability has been identified in SIMATIC Energy Manage…9.8
Are you affected by CVE-2022-23443?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST