description: An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiNAC
defaultStatus: unaffected
versions:
versionType: semver, version: 9.4.0, lessThanOrEqual: 9.4.1, status: affected
versionType: semver, version: 9.2.0, lessThanOrEqual: 9.2.7, status: affected
versionType: semver, version: 9.1.0, lessThanOrEqual: 9.1.8, status: affected
versionType: semver, version: 8.8.0, lessThanOrEqual: 8.8.11, status: affected
versionType: semver, version: 8.7.0, lessThanOrEqual: 8.7.6, status: affected
versionType: semver, version: 8.6.0, lessThanOrEqual: 8.6.5, status: affected
versionType: semver, version: 8.5.0, lessThanOrEqual: 8.5.4, status: affected
version: 8.3.7, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
]
solutions: Please upgrade to FortiNAC version 9.4.2 or above
Please upgrade to FortiNAC version 7.2.0 or above