PT-2023-1738 · Fortinet · Fortirecorder

Publicado 2023-03-07 · Atualizado 2023-04-10 · CVE-2022-41333

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiRecorder versions 6.4.3 and below FortiRecorder versions 6.0.11 and below

Description The issue is related to an uncontrolled resource consumption vulnerability. It may allow an unauthenticated attacker to make the device unavailable via crafted GET requests to the login authentication mechanism.

Recommendations For FortiRecorder versions 6.4.3 and below, update to a version above 6.4.3 to resolve the issue. For FortiRecorder versions 6.0.11 and below, update to a version above 6.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the login authentication mechanism to minimize the risk of exploitation.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2023-01329

CVE-2022-41333

Produtos afetados

Fortirecorder

Referências · 7

• 🔥 https://exploit-db.com/exploits/51326 · Exploit
• https://fortiguard.com/psirt/FG-IR-22-388 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-41333 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01329 · Nota de Segurança
• http://packetstormsecurity.com/files/171766/FortiRecorder-6.4.3-Denial-Of-Service.html · Nota
• https://t.me/cibsecurity/59600 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-41333 · Nota de Segurança