Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.6358
FortiADC - SQL injection vulnerability in configuration backup feature
7 December 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: FortiADC
Publisher: Fortinet
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2022-33875
Original Bulletin:
https://fortiguard.fortinet.com/psirt/FG-IR-22-252
Comment: CVSS (Max): 5.1 CVE-2022-33875 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS Source: Fortinet
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
FortiADC - SQL injection vulnerability in configuration backup feature
IR Number : FG-IR-22-252
Date : Dec 6, 2022
Severity : Medium
CVSSv3 Score : 5.1
Impact : Execute unauthorized code or commands
CVE ID : CVE-2022-33875
Affected Products: FortiADC: 7.1.0, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.2.4, 6.2.3, 6.2.2,
6.2.1, 6.2.0, 6.1.6, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0,
6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2,
5.4.1, 5.4.0, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1,
5.3.0, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1,
5.2.0
Summary
An improper neutralization of special elements used in an SQL Command ('SQL
Injection') vulnerability [CWE-89] in FortiADC may allow an authenticated
attacker to execute unauthorized code or commands via specifically crafted HTTP
requests.
Affected Products
FortiADC version 7.1.0
FortiADC version 7.0.0 through 7.0.2
FortiADC version 6.2.0 through 6.2.4
FortiADC version 6.1 all versions
FortiADC version 6.0 all versions
FortiADC version 5.4 all versions
FortiADC version 5.3 all versions
FortiADC version 5.2 all versions
Solutions
Please upgrade to FortiADC version 7.1.1 or above
Please upgrade to FortiADC version 7.0.3 or above
Please upgrade to FortiADC version 6.2.5 or above
Acknowledgement
Internally discovered and reported by Theo Leleu of Fortinet Product Security
team.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY4/sV8kNZI30y1K9AQibHg/+K7zFm7zqIkrbBVeEG/88XXQKypOQb9UP
KfV+lzpLEWQGXafGEX5FY1l0mGB1QvypS2TS9QHQi5HYBtIJBrScwI6O2dOUMIsR
G8yiKnkmMIbRpjGIx0KmC7jZqaSnByJmSLjMCEaIvEePZxi142l763rdcJSSCSQl
7CbPqxfSbAbKfxPWXRwWVFWFEuPVYWlost2YH52bc8clebB3ShLnaszpYSiz0hGg
hsw8pWIrbEZUEQdMXiO9o6VoHdEvYWYpu2x8z4KZZkBWDTUrmnWe2UgrZwCyKl2W
kvTeF4rClNin/11hTYOmIvEZoEtHY6tPBmMMs6CksyQqiOXCEaJ3xLUZNrvxwA21
By28j8CaKM1uky5APnGL/Dqc/V17ZSUrpAUy2Qdb/IWNz08KMf6Vw91/f0Qsmv6T
iUHsIslKdgl17p7QYd3sHVW7JSb0frJxUP28ciSAU3UNjsn47TWiegrKi8Mm7G7q
IzZDs0ffgaUaZ/BwHCdhVCjILtQ6bnLEsKwIcldSsBtLmstR/yXDW4NAxnjGIDCz
lOhOY668DL6Or9o0liEF2Lns7ThQ79lZzd/6hf+Y0wGS7ogm33hPKgL1MZ8yllBb
fWGiqFfyVd+DEpotr0AnF1fakin7ZezUqjiDoG3Pf1fzs5mYuFmNESuewTnGGQGi
zO7haVY/LjM=
=sgVZ
-----END PGP SIGNATURE-----