Lucene search

[email protected]CVE-2022-40684

HistoryOct 18, 2022 - 2:15 p.m.

CVE-2022-40684

2022-10-1814:15:09

CWE-287

[email protected]

web.nvd.nist.gov

1143

In Wild

cve-2022-40684

authentication bypass

fortinet

fortios

fortiproxy

fortiswitchmanager

cwe-288

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Affected configurations

NVD

Node

fortinetfortiproxyRange7.0.0–7.0.7

fortinetfortiproxyMatch7.2.0

fortinetfortiswitchmanagerMatch7.0.0

fortinetfortiswitchmanagerMatch7.2.0

fortinetfortiosRange7.0.0–7.0.7

fortinetfortiosRange7.2.0–7.2.2

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxylt7.0.7
fortinet:fortiproxyfortinet fortiproxyeq7.2.0
fortinet:fortiswitchmanagerfortinet fortiswitchmanagereq7.0.0
fortinet:fortiswitchmanagerfortinet fortiswitchmanagereq7.2.0
fortinet:fortiosfortinet fortioslt7.0.7
fortinet:fortiosfortinet fortioslt7.2.2

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	lt	7.0.7
fortinet:fortiproxy	fortinet fortiproxy	eq	7.2.0
fortinet:fortiswitchmanager	fortinet fortiswitchmanager	eq	7.0.0
fortinet:fortiswitchmanager	fortinet fortiswitchmanager	eq	7.2.0
fortinet:fortios	fortinet fortios	lt	7.0.7
fortinet:fortios	fortinet fortios	lt	7.2.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "Fortinet FortiOS, FortiProxy, FortiSwitchManager",
    "versions": [
      {
        "version": "FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0",
        "status": "affected"
      }
    ]
  }
]