Lucene search

FortinetVULNRICHMENT:CVE-2022-45862

HistoryAug 13, 2024 - 3:51 p.m.

CVE-2022-45862

2024-08-1315:51:57

CWE-613

fortinet

github.com

insufficient session expiration

fortios

fortiproxy

fortipam

gui

cwe-613

cve-2022-45862

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:C

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

20.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiPAM",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.0"
      },
      {
        "status": "affected",
        "version": "1.2.0"
      },
      {
        "status": "affected",
        "version": "1.1.0",
        "versionType": "semver",
        "lessThanOrEqual": "1.1.2"
      },
      {
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "1.0.3"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.11"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.18"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.5"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.7"
      },
      {
        "status": "affected",
        "version": "6.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "6.4.11"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Fortinet",
    "product": "FortiSwitchManager",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.1"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.2"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

fortiguard.com/psirt/FG-IR-22-445

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:C

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

20.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2022-45862