Lucene search

FortinetCVE-2022-45856

HistorySep 10, 2024 - 3:15 p.m.

CVE-2022-45856

2024-09-1015:15:13

CWE-295

fortinet

web.nvd.nist.gov

cve-2022-45856

forticlient

certificate validation

man-in-the-middle

saml sso

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all versions, 7.0 all versions, 7.2.0 and FortiClientiOS 5.6 all versions, 6.0.0 through 6.0.1, 7.0.0 through 7.0.6 SAML SSO feature may allow an unauthenticated attacker to man-in-the-middle the communication between the FortiClient and both the service provider and the identity provider.

Affected configurations

Nvd

Node

fortinetforticlientRange5.0–7.2.1android

Node

fortinetforticlientRange6.4–7.2.5linux

Node

fortinetforticlientRange6.4–7.2.5mac_os

Node

fortinetforticlientRange6.4–7.0.8windows

Node

fortinetforticlientRange2.0–7.0.7iphone_os

VendorProductVersionCPE
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:android:*:*
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:mac_os:*:*
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:iphone_os:*:*

Vendor	Product	Version	CPE
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::android::*
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::linux::*
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::mac_os::*
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::windows::*
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::iphone_os::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiClientiOS",
    "cpes": [
      "cpe:2.3:a:fortinet:forticlientios:7.0.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:7.0.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:7.0.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:7.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:7.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:7.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:6.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:6.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.6.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.6.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.6.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.6.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.4.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.4.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.4.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.4.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.2.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.2.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:5.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:4.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:4.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:4.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:2.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:forticlientios:2.0.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.3",
        "lessThanOrEqual": "7.0.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.6.5",
        "lessThanOrEqual": "5.6.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.6.0",
        "lessThanOrEqual": "5.6.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.3",
        "lessThanOrEqual": "5.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.2.0",
        "lessThanOrEqual": "5.2.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.0.0",
        "lessThanOrEqual": "5.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.0.0",
        "lessThanOrEqual": "4.0.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.0.0",
        "lessThanOrEqual": "2.0.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientAndroid",
    "cpes": [],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.6",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.2",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "version": "7.0.0",
        "status": "affected"
      },
      {
        "version": "6.4.6",
        "status": "affected"
      },
      {
        "version": "6.4.4",
        "status": "affected"
      },
      {
        "version": "6.4.1",
        "status": "affected"
      },
      {
        "version": "6.0.0",
        "status": "affected"
      },
      {
        "version": "5.6.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.2.0",
        "lessThanOrEqual": "5.2.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.0.0",
        "lessThanOrEqual": "5.0.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientMac",
    "cpes": [],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.13",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientLinux",
    "cpes": [],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.13",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.7",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.4",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientWindows",
    "cpes": [],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.fortinet.com/psirt/FG-IR-22-230

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

Related for CVE-2022-45856