FortiPresence - Unpassworded remotely accessible Redis & MongoDB

2023-04-1100:00:00

FortiGuard Labs

www.fortiguard.com

fortipresence

unpassworded

remote access

vulnerability

mongodb

redis

authentication

cwe-306

0.002 Low

EPSS

Percentile

55.7%

JSON

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence on-prem infrastructure server may allow a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

CPENameOperatorVersion
fortipresenceeq1.2.1
fortipresenceeq1.2.0
fortipresenceeq1.1.1
fortipresenceeq1.1.0
fortipresenceeq1.0.0

Name	Operator	Version
fortipresence	eq	1.2.1
fortipresence	eq	1.2.0
fortipresence	eq	1.1.1
fortipresence	eq	1.1.0
fortipresence	eq	1.0.0

0.002 Low

EPSS

Percentile

55.7%

JSON

Related for FG-IR-22-355