VYPR
← All advisories
High severity7.3NVD Advisory· Published Feb 16, 2023· Updated Jun 17, 2026

CVE-2022-39954

CVE-2022-39954

Description

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.

Affected products

4
  • Fortinet/Fortinac F3 versions
    cpe:2.3:a:fortinet:fortinac-f:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortinac-f:*:*:*:*:*:*:*:*range: <7.2.0
    • (no CPE)range: 9.4.0-9.4.1, 9.2.0-9.2.7, 9.1.0-9.1.8, 8.8.0-8.8.11, 8.7.0-8.7.6, 8.6.0-8.6.5, 8.5.0-8.5.4, 8.3.7
    • (no CPE)range: 9.4.0
  • Fortinet/Fortinac
    cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
    Range: >=8.3.7,<=9.2.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.