CVE-2022-39948

🗓️ 16 Feb 2023 18:06:29Reported by fortinetType

An improper certificate validation vulnerability in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy

Reporter	Title	Published	Views	Family All 13
CNNVD	Fortinet FortiOS 信任管理问题漏洞	16 Feb 202300:00	–	cnnvd
Cvelist	CVE-2022-39948	16 Feb 202318:06	–	cvelist
EUVD	EUVD-2022-42392	3 Oct 202520:07	–	euvd
Fortinet	Protect	16 Feb 202300:00	–	fortinet
Tenable Nessus	Fortinet Fortigate Lack of certificate verification when establishing secure connections with threat feed fabric connectors (FG-IR-22-257)	17 Apr 202300:00	–	nessus
ICS	Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices	12 Mar 202400:00	–	ics
NCSC	Vulnerabilities fixed in FortiNet FortiOS	17 Feb 202300:00	–	ncsc
NCSC	Vulnerabilities fixed in Siemens products	12 Mar 202400:00	–	ncsc
NVD	CVE-2022-39948	16 Feb 202319:15	–	nvd
OSV	CVE-2022-39948	16 Feb 202319:15	–	osv

NVD

Node

fortinet fortiproxyRange1.2.0–2.0.9

fortinet fortiproxyRange7.0.0–7.0.7

fortinet fortiosRange6.0.0–7.0.8

fortinet fortiosRange7.2.0–7.2.4

[
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.0.0",
        "lessThanOrEqual": "2.0.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.2.0",
        "lessThanOrEqual": "1.2.13",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.12",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.16",
        "status": "affected"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/psirt/FG-IR-22-257

21 Nov 2024 07:18Current

7.4High risk

Vulners AI Score7.4

CVSS 3.14.8 - 7.4

EPSS0.00211

SSVC

CWE-295