CVE-2022-35845

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-35845", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2022-07-13T20:38:49.333Z", "datePublished": "2023-01-03T16:57:58.754Z", "dateUpdated": "2024-10-23T14:51:17.532Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiTester", "defaultStatus": "unaffected", "versions": [{"version": "7.1.0", "status": "affected"}, {"version": "7.0.0", "status": "affected"}, {"version": "4.2.0", "status": "affected"}, {"versionType": "semver", "version": "4.1.0", "lessThanOrEqual": "4.1.1", "status": "affected"}, {"version": "4.0.0", "status": "affected"}, {"versionType": "semver", "version": "3.9.0", "lessThanOrEqual": "3.9.1", "status": "affected"}, {"version": "3.8.0", "status": "affected"}, {"versionType": "semver", "version": "3.7.0", "lessThanOrEqual": "3.7.1", "status": "affected"}, {"version": "3.6.0", "status": "affected"}, {"versionType": "semver", "version": "3.5.0", "lessThanOrEqual": "3.5.1", "status": "affected"}, {"version": "3.4.0", "status": "affected"}, {"versionType": "semver", "version": "3.3.0", "lessThanOrEqual": "3.3.1", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "2.9.0", "status": "affected"}, {"version": "2.8.0", "status": "affected"}, {"version": "2.7.0", "status": "affected"}, {"version": "2.6.0", "status": "affected"}, {"version": "2.5.0", "status": "affected"}, {"versionType": "semver", "version": "2.4.0", "lessThanOrEqual": "2.4.1", "status": "affected"}, {"version": "2.3.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-01-03T16:57:58.754Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiTester version 7.2.0 or above Please upgrade to FortiTester version 7.1.1 or above Please upgrade to FortiTester version 4.2.1 or above Please upgrade to FortiTester version 3.9.2 or above "}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-274", "url": "https://fortiguard.com/psirt/FG-IR-22-274"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:44:22.118Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-274", "url": "https://fortiguard.com/psirt/FG-IR-22-274", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-23T14:12:04.902426Z", "id": "CVE-2022-35845", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T14:51:17.532Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-274", "name": "https://fortiguard.com/psirt/FG-IR-22-274", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:44:22.118Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-35845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-23T14:12:04.902426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T14:15:41.153Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Fortinet", "product": "FortiTester", "versions": [{"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.1.0", "versionType": "semver", "lessThanOrEqual": "4.1.1"}, {"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "3.9.0", "versionType": "semver", "lessThanOrEqual": "3.9.1"}, {"status": "affected", "version": "3.8.0"}, {"status": "affected", "version": "3.7.0", "versionType": "semver", "lessThanOrEqual": "3.7.1"}, {"status": "affected", "version": "3.6.0"}, {"status": "affected", "version": "3.5.0", "versionType": "semver", "lessThanOrEqual": "3.5.1"}, {"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.3.0", "versionType": "semver", "lessThanOrEqual": "3.3.1"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "2.9.0"}, {"status": "affected", "version": "2.8.0"}, {"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.5.0"}, {"status": "affected", "version": "2.4.0", "versionType": "semver", "lessThanOrEqual": "2.4.1"}, {"status": "affected", "version": "2.3.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiTester version 7.2.0 or above Please upgrade to FortiTester version 7.1.1 or above Please upgrade to FortiTester version 4.2.1 or above Please upgrade to FortiTester version 3.9.2 or above "}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-274", "name": "https://fortiguard.com/psirt/FG-IR-22-274"}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-01-03T16:57:58.754Z"}}}, "cveMetadata": {"cveId": "CVE-2022-35845", "state": "PUBLISHED", "dateUpdated": "2024-10-23T14:51:17.532Z", "dateReserved": "2022-07-13T20:38:49.333Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2023-01-03T16:57:58.754Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FortiTester", "vendor": "Fortinet", "versions": [{"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "4.2.0"}, {"lessThanOrEqual": "4.1.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"status": "affected", "version": "4.0.0"}, {"lessThanOrEqual": "3.9.1", "status": "affected", "version": "3.9.0", "versionType": "semver"}, {"status": "affected", "version": "3.8.0"}, {"lessThanOrEqual": "3.7.1", "status": "affected", "version": "3.7.0", "versionType": "semver"}, {"status": "affected", "version": "3.6.0"}, {"lessThanOrEqual": "3.5.1", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"status": "affected", "version": "3.4.0"}, {"lessThanOrEqual": "3.3.1", "status": "affected", "version": "3.3.0", "versionType": "semver"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "2.9.0"}, {"status": "affected", "version": "2.8.0"}, {"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.5.0"}, {"lessThanOrEqual": "2.4.1", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"status": "affected", "version": "2.3.0"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*", "matchCriteriaId": "00C0E7B6-1837-4D91-A582-95455D0AA092", "versionEndIncluding": "3.9.1", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "23A3ABD7-9694-4784-9CD4-E8A1FA715682", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E79982C9-CB89-41B9-A294-B9830897304A", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7BB327AD-00E1-4397-B992-E182785E8ECC", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E47F051E-5D15-456D-9C0D-1AE6FF347155", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "90D54E79-62C6-427F-9DD1-B3A99944E418", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortitester:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "48797E89-FD8C-4904-9A8B-55F8D3840DB2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo ('inyecci\u00f3n de comando del sistema operativo') [CWE-78] en FortiTester 7.1.0, 7.0 todas las versiones, 4.0.0 a 4.2.0, 2.3.0 a 3.9.1 pueden permitir que un atacante autenticado ejecute comandos arbitrarios en el shell subyacente."}], "id": "CVE-2022-35845", "lastModified": "2026-06-17T04:52:23.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-35845", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-23T14:12:04.902426Z", "version": "2.0.3"}}]}, "published": "2023-01-03T17:15:10.327", "references": [{"source": "psirt@fortinet.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-22-274"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-22-274"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}