CVE-2022-41329

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Fortinet	FortiProxy	>= 7.2.0, <= 7.2.2; >= 7.0.0, <= 7.0.8
Fortinet	FortiOS	>= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.9; >= 6.4.0, <= 6.4.12; >= 6.2.3, <= 6.2.13

References

https://fortiguard.com/psirt/FG-IR-22-364Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-364Vendor Advisory

Timeline

Published: Mar 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-413306.1An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7 CVE-2022-413319.8A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a CVE-2022-413337.5An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication CVE-2022-413346.1An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 CVE-2022-413358.1A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, For CVE-2022-413364.8An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all v CVE-2022-413397.8In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation.CVE-2022-41342.8A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integr CVE-2022-413407.5The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.CVE-2022-413427.8Improper buffer restrictions in the Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2 CVE-2022-413437.5registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font regi CVE-2022-413477.8An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execut