Lucene search

FortinetCVE-2022-29056

HistoryMar 09, 2023 - 3:15 p.m.

CVE-2022-29056

2023-03-0915:15:09

CWE-307

fortinet

web.nvd.nist.gov

cve-2022-29056

cwe-307

fortinet

fortimail

vulnerability

remote attack

cpu exhaustion

memory exhaustion

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

50.7%

JSON

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

Affected configurations

Nvd

Node

fortinetfortimailRange6.0.0–6.0.10

fortinetfortimailRange6.2.1–6.2.5

fortinetfortimailMatch6.4.0

VendorProductVersionCPE
fortinetfortimail*cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
fortinetfortimail6.4.0cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortimail	*	cpe:2.3:a:fortinet:fortimail::::::::
fortinet	fortimail	6.4.0	cpe:2.3:a:fortinet:fortimail:6.4.0:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiMail",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "6.4.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.1",
        "lessThanOrEqual": "6.2.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.12",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-20-078

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

50.7%

JSON

Related for CVE-2022-29056