PT-2023-12861 · Fortinet · Fortisandbox

Publicado 2023-02-16 · Atualizado 2023-02-24 · CVE-2022-26115

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 4.2.0

Description The issue is related to the use of password hash with insufficient computational effort, allowing an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

Recommendations For versions prior to 4.2.0, update to version 4.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the password database to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-916

Identificadores relacionados

CVE-2022-26115

Produtos afetados

Fortisandbox

Referências · 4

• https://fortiguard.com/psirt/FG-IR-20-220 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-26115 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-26115 · Nota de Segurança
• https://t.me/cibsecurity/58382 · Publicação no Telegram