Lucene search

FortinetCVELIST:CVE-2022-23441

HistoryApr 06, 2022 - 9:10 a.m.

CVE-2022-23441

2022-04-0609:10:10

fortinet

www.cve.org

cryptographic key

vulnerability

fortiedr

unauthenticated attacker

network

message forgery

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:C

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the network to disguise as and forge messages from other collectors.

CNA Affected

[
  {
    "product": "Fortinet FortiEDR",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiEDR 5.0.2, 5.0.1, 5.0.0, 4.0.0"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-019

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:C

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVELIST:CVE-2022-23441