Lucene search

[email protected]CVE-2023-22642

HistoryApr 11, 2023 - 5:15 p.m.

CVE-2023-22642

2023-04-1117:15:08

CWE-295

[email protected]

web.nvd.nist.gov

cve-2023-22642

fortianalyzer

fortimanager

cwe-295

certificate validation

man-in-the-middle

security vulnerability

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.0%

JSON

An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources.

Affected configurations

NVD

Node

fortinetfortianalyzerRange6.4.8–6.4.11

fortinetfortianalyzerRange7.0.0–7.0.6

fortinetfortianalyzerRange7.2.0–7.2.2

fortinetfortimanagerRange6.4.8–6.4.11

fortinetfortimanagerRange7.0.0–7.0.6

fortinetfortimanagerRange7.2.0–7.2.2

CPENameOperatorVersion
fortinet:fortianalyzerfortinet fortianalyzerlt6.4.11
fortinet:fortianalyzerfortinet fortianalyzerlt7.0.6
fortinet:fortianalyzerfortinet fortianalyzerlt7.2.2
fortinet:fortimanagerfortinet fortimanagerlt6.4.11
fortinet:fortimanagerfortinet fortimanagerlt7.0.6
fortinet:fortimanagerfortinet fortimanagerlt7.2.2

CPE	Name	Operator	Version
fortinet:fortianalyzer	fortinet fortianalyzer	lt	6.4.11
fortinet:fortianalyzer	fortinet fortianalyzer	lt	7.0.6
fortinet:fortianalyzer	fortinet fortianalyzer	lt	7.2.2
fortinet:fortimanager	fortinet fortimanager	lt	6.4.11
fortinet:fortimanager	fortinet fortimanager	lt	7.0.6
fortinet:fortimanager	fortinet fortimanager	lt	7.2.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiAnalyzer",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.8",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThan": "6.4.*",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiManager",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.8",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThan": "6.4.*",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-502

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.0%

JSON

Related for CVE-2023-22642

fortinet1 prion1 cvelist1 nvd1