CVE-2022-27484

MEDIUM

FortiADC 5.0.0-6.2.3 - Authenticated Password Change Bypass via Crafted HTTP Request

Title source: llm

Description

A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/psirt/FG-IR-22-055

Scores

CVSS v3 5.4

EPSS 0.0013

EPSS Percentile 32.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (1)

fortinet/fortiadc 5.0.0 - 6.2.4

Published Aug 03, 2022

Tracked Since Feb 18, 2026