CVE-2022-22300

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-01 · updated 2026-06-17
Weakness: CWE-755

Description

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.

Affected products

Fortinet FortiAnalyzer: from 5.6.0 through 5.6.11; from 6.0.0 through 6.0.11; from 6.2.0 through 6.2.9; from 6.4.0 through 6.4.7; from 7.0.0 before 7.0.3 — fixed in 7.0.3
Fortinet FortiManager: from 5.6.0 through 5.6.11; from 6.0.0 through 6.0.11; from 6.2.0 through 6.2.9; from 6.4.0 through 6.4.7; from 7.0.0 before 7.0.3 — fixed in 7.0.3

How to fix

Upgrade to a fixed version: Fortinet FortiAnalyzer 7.0.3; Fortinet FortiManager 7.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22300 or the next vulnerability affects your stack