Skip to content
fr Sign in
6.9 Medium

CVE-2022-39954 An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC…

Description

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.

Affected products and versions

Product Affected versions Fixed in
FortiNAC 9.4 9.4.0 → 9.4.1 No fix stated
FortiNAC 9.2 9.2.0 → 9.2.7 No fix stated
FortiNAC 9.1 9.1.0 → 9.1.8 No fix stated
FortiNAC 8.8 8.8.0 → 8.8.11 No fix stated
FortiNAC 8.7 8.7.0 → 8.7.6 No fix stated
FortiNAC 8.6 8.6.0 → 8.6.5 No fix stated
FortiNAC 8.5 8.5.0 → 8.5.4 No fix stated
FortiNAC 8.3.7 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiNAC

The 23 CVEs of FortiNAC →
CVE-2023-33300 A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and… 4.8 Medium CVE-2024-31488 An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through… 6.1 Medium CVE-2023-26206 An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 -… 6.8 Medium CVE-2023-33299 A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier… 9.6 Critical
Track this CVE