CVE-2022-23442: 
FortiOS vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2022-23442) was identified in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.5. The vulnerability was disclosed on August 2, 2022, and received a CVSS v3.1 base score of 4.3 (Medium severity) (Fortiguard PSIRT, NVD).

The vulnerability is classified as an improper access control issue [CWE-284] that affects FortiOS systems. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, unchanged scope, and low impact on confidentiality with no impact on integrity or availability (NVD).

The vulnerability allows an authenticated attacker with a restricted user profile to gather checksum information about other VDOMs (Virtual Domains) via CLI commands. The impact is limited to information disclosure with no direct effect on system integrity or availability (Fortiguard PSIRT).

The vulnerability requires network access and low privileges for exploitation. An attacker must have valid authentication credentials with a restricted user profile to exploit this vulnerability (NVD).

Organizations should upgrade to versions newer than FortiOS 6.2.11, 6.4.8, or 7.0.5 to address this vulnerability (Fortiguard PSIRT).