Fortinet Security Updates – 12 April 2023

The addressed vulnerabilities could allow the attacker to execute arbitrary code, escalate privileges, bypass security restrictions, obtain information, cause crosssite scripting, and gain access to the affected products.

Sample of the addressed vulnerabilities:

1. FortiPresence – Unpassworded Remotely Accessible Redis & MongoDB (CVE-2022-41331):

• CVSS: 9.3
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

2. FortiOS & FortiProxy – Cross-Site Scripting Vulnerabilities in the Administrative Interface (CVE-2022-41330):

• CVSS: 8.3
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Consequences: Cross-Site Scripting

Sample of affected products:

• FortiPresence.
• FortiClientWindows.
• FortiDDoS.
• FortiNAC.
• FortiSOAR.