Veille CVE
CVE-2022-40684
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Fortinet Multiple Products Authentication Bypass Vulnerability
Ajoutée le 11/10/2022 · Échéance de correction (agences US) : 01/11/2022
Action requise : Apply updates per vendor instructions.
Description
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | psirt@fortinet.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html ExploitThird Party AdvisoryVDB Entry
- https://fortiguard.com/psirt/FG-IR-22-377 MitigationVendor Advisory
- http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html ExploitThird Party AdvisoryVDB Entry
- https://fortiguard.com/psirt/FG-IR-22-377 MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684 US Government Resource