{
  "id": "CVE-2022-27490",
  "sourceIdentifier": "psirt@fortinet.com",
  "published": "2023-03-07T17:15:11.793",
  "lastModified": "2023-11-07T03:45:20.690",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      },
      {
        "source": "psirt@fortinet.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "source": "psirt@fortinet.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.6.0",
              "versionEndIncluding": "5.6.11",
              "matchCriteriaId": "F405CC91-9EDE-43F4-ACB3-5744F0FAB7BF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.4",
              "matchCriteriaId": "FA8E8156-7599-413E-9F09-A4E92362E191"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.6.0",
              "versionEndIncluding": "5.6.11",
              "matchCriteriaId": "BC5BB5B9-7C51-4840-9D25-DA41C0EF16C6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.4",
              "matchCriteriaId": "CD13669B-47CA-41CA-8D0A-514AEFD68FF1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.1.0",
              "versionEndIncluding": "4.1.2",
              "matchCriteriaId": "38B071DD-7C34-4EDC-9D87-EE0C32DA8256"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.2.0",
              "versionEndIncluding": "4.2.2",
              "matchCriteriaId": "D1E4F9F9-1BF0-4DA3-A5DE-D770BD40D324"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndIncluding": "5.0.3",
              "matchCriteriaId": "4AE4255A-A854-4A11-8860-A558E1D77F30"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.1.0",
              "versionEndIncluding": "5.1.2",
              "matchCriteriaId": "6F09B0F2-D95C-478B-9AA2-CCE1D2D1E497"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.2.0",
              "versionEndIncluding": "5.2.6",
              "matchCriteriaId": "51CAE1B0-E321-462F-B503-2C13AEF3DAAD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.3.0",
              "versionEndIncluding": "5.3.8",
              "matchCriteriaId": "44C143C2-D850-4768-94D0-55615D670A47"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.9",
              "matchCriteriaId": "8835F5DA-F19B-473E-AA9D-D6C7E8948A9E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.7",
              "matchCriteriaId": "843F4434-651D-4A22-80C3-77397E059A98"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2.0",
              "versionEndIncluding": "6.2.7",
              "matchCriteriaId": "549EE910-DAC4-45B7-AE45-6B6A786CD2F5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.4.0",
              "versionEndIncluding": "6.4.10",
              "matchCriteriaId": "4EAE583E-5D26-4224-AB58-DC3E4A6EA505"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndIncluding": "7.0.4",
              "matchCriteriaId": "2681D458-EE55-478D-92D1-C6BB7BB3BAC4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-18-232",
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}