PT-2023-1877 · Fortinet · Fortimail

Publicado 2023-03-07 · Atualizado 2023-03-15 · CVE-2022-29056

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FortiMail versions 6.2.0 through 6.2.4 FortiMail version 6.4.0 FortiMail versions prior to 6.0.9

Description The issue is related to an improper restriction of excessive authentication attempts, allowing a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form. This can potentially lead to unauthorized access to protected information.

Recommendations For FortiMail versions 6.2.0 through 6.2.4, update to a version that includes a fix for this issue. For FortiMail version 6.4.0, update to a version that includes a fix for this issue. For FortiMail versions prior to 6.0.9, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the login form to minimize the risk of exploitation.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

BDU:2023-01478

CVE-2022-29056

Produtos afetados

Fortimail

Referências · 6

• https://osv.dev/vulnerability/CVE-2022-29056 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-20-078 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-29056 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01478 · Nota de Segurança
• https://t.me/cvenotify/45876 · Publicação no Telegram
• https://t.me/cibsecurity/59732 · Publicação no Telegram