CVE-2022-38377: Fortinet Fortianalyzer

Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information.

Affected products

• Fortinet Fortianalyzer: from 6.0.0, up to and including 6.0.12; from 6.2.0, up to and including 6.2.10; from 6.4.0, up to and including 6.4.8; from 7.0.0, up to and including 7.0.3; version 7.2.0 only
• Fortinet FortiManager: from 6.0.0, up to and including 6.0.11; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.7; from 7.0.0, up to and including 7.0.3; version 7.2.0 only

Published 2022-11-25. Last modified 2026-06-17.