CVE-2022-33875

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-33875", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "requesterUserId": "a0475cc0-be89-4a25-97b3-d1b8023a8677", "dateReserved": "2022-06-16T11:14:43.764Z", "datePublished": "2022-12-06T16:01:04.481Z", "dateUpdated": "2024-10-22T20:51:13.857Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiADC", "defaultStatus": "unaffected", "versions": [{"version": "7.1.0", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.4", "status": "affected"}, {"versionType": "semver", "version": "6.1.0", "lessThanOrEqual": "6.1.6", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.4", "status": "affected"}, {"versionType": "semver", "version": "5.4.0", "lessThanOrEqual": "5.4.5", "status": "affected"}, {"versionType": "semver", "version": "5.3.0", "lessThanOrEqual": "5.3.7", "status": "affected"}, {"versionType": "semver", "version": "5.2.0", "lessThanOrEqual": "5.2.8", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated\u00a0attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2022-12-06T16:01:04.481Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiADC version 7.1.1 or above Please upgrade to FortiADC version 7.0.3 or above Please upgrade to FortiADC version 6.2.5 or above "}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-252", "url": "https://fortiguard.com/psirt/FG-IR-22-252"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T08:09:22.672Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-252", "url": "https://fortiguard.com/psirt/FG-IR-22-252", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T20:18:48.144389Z", "id": "CVE-2022-33875", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T20:51:13.857Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-33875", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "requesterUserId": "a0475cc0-be89-4a25-97b3-d1b8023a8677", "dateReserved": "2022-06-16T11:14:43.764Z", "datePublished": "2022-12-06T16:01:04.481Z", "dateUpdated": "2024-10-22T20:51:13.857Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiADC", "defaultStatus": "unaffected", "versions": [{"version": "7.1.0", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.4", "status": "affected"}, {"versionType": "semver", "version": "6.1.0", "lessThanOrEqual": "6.1.6", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.4", "status": "affected"}, {"versionType": "semver", "version": "5.4.0", "lessThanOrEqual": "5.4.5", "status": "affected"}, {"versionType": "semver", "version": "5.3.0", "lessThanOrEqual": "5.3.7", "status": "affected"}, {"versionType": "semver", "version": "5.2.0", "lessThanOrEqual": "5.2.8", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated\u00a0attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2022-12-06T16:01:04.481Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiADC version 7.1.1 or above Please upgrade to FortiADC version 7.0.3 or above Please upgrade to FortiADC version 6.2.5 or above "}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-252", "url": "https://fortiguard.com/psirt/FG-IR-22-252"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T08:09:22.672Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-252", "url": "https://fortiguard.com/psirt/FG-IR-22-252", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-33875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T20:18:48.144389Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T20:21:05.669Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FortiADC", "vendor": "Fortinet", "versions": [{"status": "affected", "version": "7.1.0"}, {"lessThanOrEqual": "7.0.3", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.4", "status": "affected", "version": "6.2.0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.6", "status": "affected", "version": "6.1.0", "versionType": "semver"}, {"lessThanOrEqual": "6.0.4", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.5", "status": "affected", "version": "5.4.0", "versionType": "semver"}, {"lessThanOrEqual": "5.3.7", "status": "affected", "version": "5.3.0", "versionType": "semver"}, {"lessThanOrEqual": "5.2.8", "status": "affected", "version": "5.2.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "186A898A-F330-49A1-9E29-60F9C95DC4C6", "versionEndIncluding": "6.2.4", "versionStartIncluding": "5.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D78A58AA-5F2F-4CC3-8299-EC320E36CF5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "CE3123F6-4360-45F8-9A90-C0D35CC73D1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "B5720B3B-3C57-43E6-B453-65851A46E724", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "B35D8D53-448B-474C-B7CB-324CB4ED7A82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated\u00a0attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}, {"lang": "es", "value": "Una neutralizaci\u00f3n incorrecta de elementos especiales utilizados en una vulnerabilidad de Comando SQL (\"Inyecci\u00f3n SQL\") en Fortinet FortiADC versi\u00f3n 7.1.0, versi\u00f3n 7.0.0 a 7.0.2 y versi\u00f3n 6.2.4 y anteriores permite a un atacante autenticado ejecutar c\u00f3digo no autorizado o comandos a trav\u00e9s de solicitudes HTTP espec\u00edficamente manipuladas."}], "id": "CVE-2022-33875", "lastModified": "2026-06-17T04:49:24.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-33875", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T20:18:48.144389Z", "version": "2.0.3"}}]}, "published": "2022-12-06T17:15:10.750", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-22-252"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-22-252"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}