FortinetCVE-2022-29060CVE-2022-29060
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
58.3%
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fortinet | fortiddos | 5.1.0 | cpe:2.3:a:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.2.0 | cpe:2.3:a:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.3.0 | cpe:2.3:a:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.3.1 | cpe:2.3:a:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.0 | cpe:2.3:a:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.1 | cpe:2.3:a:fortinet:fortiddos:5.4.1:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.4.2 | cpe:2.3:a:fortinet:fortiddos:5.4.2:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.5.0 | cpe:2.3:a:fortinet:fortiddos:5.5.0:*:*:*:*:*:*:* |
| fortinet | fortiddos | 5.5.1 | cpe:2.3:a:fortinet:fortiddos:5.5.1:*:*:*:*:*:*:* |
CNA Affected
[
{
"product": "Fortinet FortiDDoS",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "FortiDDoS 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0"
}
]
}
]References
Social References
More
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
58.3%