Lucene search
HistoryJul 19, 2022 - 2:15 p.m.
CVE-2022-29060
cve-2022-29060
cwe-321
fortiddos
cryptographic key
jwt tokens
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.
Affected configurations
Node
fortinetfortiddosMatch5.1.0
ORfortinetfortiddosMatch5.2.0
ORfortinetfortiddosMatch5.3.0
ORfortinetfortiddosMatch5.3.1
ORfortinetfortiddosMatch5.4.0
ORfortinetfortiddosMatch5.4.1
ORfortinetfortiddosMatch5.4.2
ORfortinetfortiddosMatch5.5.0
ORfortinetfortiddosMatch5.5.1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fortinet | fortiddos | 5.1.0 | cpe:2.3:a:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.2.0 | cpe:2.3:a:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.3.0 | cpe:2.3:a:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.3.1 | cpe:2.3:a:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.0 | cpe:2.3:a:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.1 | cpe:2.3:a:fortinet:fortiddos:5.4.1:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.2 | cpe:2.3:a:fortinet:fortiddos:5.4.2:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.5.0 | cpe:2.3:a:fortinet:fortiddos:5.5.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.5.1 | cpe:2.3:a:fortinet:fortiddos:5.5.1:*:*:*:*:*:*:* |
References
Related
cvelist
cvelist
CVE-2022-29060
2022-07-18 16:35:37
fortinet
fortinet
FortiDDoS - Use of hardcoded key for the JWT token
2022-06-07 00:00:00
cve
cve
CVE-2022-29060
2022-07-19 14:15:08
prion
prion
Hardcoded credentials
2022-07-19 14:15:00
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
58.3%
Related for NVD:CVE-2022-29060