{"api_version":"1","generated_at":"2026-07-23T14:30:21+00:00","cve":"CVE-2022-38378","urls":{"html":"https://cve.report/CVE-2022-38378","api":"https://cve.report/api/cve/CVE-2022-38378.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-38378","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-38378"},"summary":{"title":"CVE-2022-38378","description":"An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.","state":"PUBLIC","assigner":"psirt@fortinet.com","published_at":"2023-02-16 19:15:00","updated_at":"2023-11-07 03:50:00"},"problem_types":["CWE-269"],"metrics":[],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-346","name":"https://fortiguard.com/psirt/FG-IR-22-346","refsource":"MISC","tags":[],"title":"FortiGuard","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38378","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38378","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"38378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortios","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"38378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiproxy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"38378","vulnerable":"1","versionEndIncluding":"2.0.9","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"fortiproxy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-38378","qid":"43979","title":"Fortinet FortiOS Escalation of Privilege Vulnerability (FG-IR-22-346)"},{"cve":"CVE-2022-38378","qid":"44039","title":"Fortinet FortiOS Escalation of Privilege Vulnerability (FG-IR-22-346) (Unauthenticated Check)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-38378","ASSIGNER":"psirt@fortinet.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Escalation of privilege","cweId":"CWE-269"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Fortinet","product":{"product_data":[{"product_name":"FortiOS","version":{"version_data":[{"version_affected":"=","version_value":"7.2.0"},{"version_affected":"<=","version_name":"7.0.0","version_value":"7.0.7"},{"version_affected":"<=","version_name":"6.4.0","version_value":"6.4.11"},{"version_affected":"<=","version_name":"6.2.0","version_value":"6.2.12"},{"version_affected":"<=","version_name":"6.0.0","version_value":"6.0.16"}]}},{"product_name":"FortiProxy","version":{"version_data":[{"version_affected":"<=","version_name":"7.2.0","version_value":"7.2.1"},{"version_affected":"<=","version_name":"7.0.0","version_value":"7.0.7"},{"version_affected":"<=","version_name":"2.0.0","version_value":"2.0.11"},{"version_affected":"<=","version_name":"1.2.0","version_value":"1.2.13"},{"version_affected":"<=","version_name":"1.1.0","version_value":"1.1.6"}]}}]}}]}},"references":{"reference_data":[{"url":"https://fortiguard.com/psirt/FG-IR-22-346","refsource":"MISC","name":"https://fortiguard.com/psirt/FG-IR-22-346"}]},"solution":[{"lang":"en","value":"Please upgrade to FortiOS version 7.2.1 or above Please upgrade to FortiOS version 7.0.8 or above Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above "}],"impact":{"cvss":[{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}]}},"nvd":{"publishedDate":"2023-02-16 19:15:00","lastModifiedDate":"2023-11-07 03:50:00","problem_types":["CWE-269"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.8,"impactScore":5.2}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"7.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.0","versionEndIncluding":"2.0.9","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}