Dashboard / CVE-2022-42476

CVE-2022-42476

HIGH
MEDIUM Priority: 0.02 BB Relevance: 36/100
Published: 2023-03-07 Modified: 2026-10-22 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Local
AC: Low
PR: High
UI: None
S: Changed
C: High
I: High
A: High

Description

A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

Weakness Classification (2)

Affected Software (10)

VendorProductVersion
fortinet fortios 6.2.0 – 6.2.12
fortinet fortios 6.4.0 – 6.4.11
fortinet fortios 7.0.0 – 7.0.8
fortinet fortios 7.2.0 – 7.2.3
fortinet fortiproxy 1.1.0 – 1.1.6
fortinet fortiproxy 1.2.0 – 1.2.13
fortinet fortiproxy 2.0.0 – 2.0.11
fortinet fortiproxy 7.0.0 – 7.0.7
fortinet fortiproxy 7.2.0
fortinet fortiproxy 7.2.1

References & Advisories (1)

Bug Bounty Relevance

36 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.22%
Raw Score 0.002180
Percentile 12.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00218
2026-10-28
0.00218

Intelligence Sources

nvd ref →

External Links