{
  "document" : {
    "aggregate_severity" : {
      "text" : "hoch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "FortiMail ist eine Aplliance zum Schutz gegen die von E-Mails übertragenen Bedrohungen.\r\nFortiRecorder ist eine Netzwerk-Videorecorder (NVR) für Videoüberwachungsanlagen.\r\nFortiSwitch bezeichnet die Ethernet Switch Produktfamilie von Fortinet.\r\nFortiVoice Enterprise ist eine Unified Communications-Lösung.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiSwitch und Fortinet FortiVoice ausnutzen, um einen Cross-Site Request Forgery Angriff durchzuführen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Sonstiges",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2023-3116 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3116.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2023-3116 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3116"
    }, {
      "category" : "external",
      "summary" : "FortiGuard PSIRT Advisory vom 2023-12-12",
      "url" : "https://fortiguard.fortinet.com/psirt/FG-IR-22-038"
    } ],
    "source_lang" : "en-US",
    "title" : "Fortinet Produkte: Schwachstelle ermöglicht Cross-Site Request Forgery",
    "tracking" : {
      "current_release_date" : "2023-12-12T23:00:00.000+00:00",
      "generator" : {
        "date" : "2024-08-15T18:02:41.390+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.3.5"
        }
      },
      "id" : "WID-SEC-W-2023-3116",
      "initial_release_date" : "2023-12-12T23:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2023-12-12T23:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      } ],
      "status" : "final",
      "version" : "1"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Fortinet FortiMail < 7.0.4",
          "product" : {
            "name" : "Fortinet FortiMail < 7.0.4",
            "product_id" : "T031628",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortimail:7.0.4"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiMail < 6.4.7",
          "product" : {
            "name" : "Fortinet FortiMail < 6.4.7",
            "product_id" : "T031629",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortimail:6.4.7"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiMail < 7.2",
          "product" : {
            "name" : "Fortinet FortiMail < 7.2",
            "product_id" : "T031636",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortimail:7.2"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "FortiMail"
      }, {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Fortinet FortiRecorder < 6.4.3",
          "product" : {
            "name" : "Fortinet FortiRecorder < 6.4.3",
            "product_id" : "T031630",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:fortinet:fortirecorder_firmware:6.4.3"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiRecorder < 6.0.12",
          "product" : {
            "name" : "Fortinet FortiRecorder < 6.0.12",
            "product_id" : "T031631",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:fortinet:fortirecorder_firmware:6.0.12"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiRecorder < 7.0",
          "product" : {
            "name" : "Fortinet FortiRecorder < 7.0",
            "product_id" : "T031637",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:fortinet:fortirecorder_firmware:7.0"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "FortiRecorder"
      }, {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Fortinet FortiSwitch < 7.0.5",
          "product" : {
            "name" : "Fortinet FortiSwitch < 7.0.5",
            "product_id" : "T031632",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:fortinet:fortiswitch:7.0.5"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiSwitch < 6.4.11",
          "product" : {
            "name" : "Fortinet FortiSwitch < 6.4.11",
            "product_id" : "T031633",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:fortinet:fortiswitch:6.4.11"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiSwitch < 7.2",
          "product" : {
            "name" : "Fortinet FortiSwitch < 7.2",
            "product_id" : "T031638",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:fortinet:fortiswitch:7.2"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "FortiSwitch"
      }, {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Fortinet FortiVoice < 6.4.8",
          "product" : {
            "name" : "Fortinet FortiVoice < 6.4.8",
            "product_id" : "T031634",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortivoice:6.4.8"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiVoice < 6.0.12",
          "product" : {
            "name" : "Fortinet FortiVoice < 6.0.12",
            "product_id" : "T031635",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortivoice:6.0.12"
            }
          }
        }, {
          "category" : "product_name",
          "name" : "Fortinet FortiVoice < 7.0",
          "product" : {
            "name" : "Fortinet FortiVoice < 7.0",
            "product_id" : "T031639",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:fortinet:fortivoice:7.0"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "FortiVoice"
      } ],
      "category" : "vendor",
      "name" : "Fortinet"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2022-27488",
    "notes" : [ {
      "category" : "description",
      "text" : "In verschiedenen Fortinet Produkten existiert eine Cross-Site Request Forgery Schwachstelle bezüglich der \"HTTPd CLI console\". Ein Angreifer kann dies ausnutzen, um mittels manipulierter Links beliebige Kommandos auf dem CLI auszuführen. Zur erfolgreichen Ausnutzung muss ein angemeldeter Administrator einen manipulierten Link anklicken."
    } ],
    "release_date" : "2023-12-12T23:00:00.000+00:00",
    "title" : "CVE-2022-27488"
  } ]
}