CVE-2022-39946

HIGH

FortiNAC <= 9.4.2, <= 9.2.7, 9.1, 8.8, 8.7, 8.6, 8.5 - Authenticated Unauthorized JSP Calls via Crafted HTTP Requests

Title source: llm

Description

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-332

Scores

CVSS v3 7.6

EPSS 0.0023

EPSS Percentile 46.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (4)

fortinet/fortinac 9.4.0

fortinet/fortinac 9.4.1

fortinet/fortinac 9.4.2

fortinet/fortinac 8.5.0 - 8.5.4

Published Jun 13, 2023

Tracked Since Feb 18, 2026