PT-2022-15346 · Fortinet · Fortianalyzer+3

Published 2022-06-07 · Updated 2023-09-07 · CVE-2022-22305

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.0.1 and below, 6.4.6 and below FortiAnalyzer versions 7.0.2 and below, 6.4.7 and below FortiOS versions 6.2.x and 6.0.x FortiSandbox versions 4.0.x, 3.2.x and 3.1.x

Description An improper certificate validation issue may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.

Recommendations For FortiManager versions 7.0.1 and below, 6.4.6 and below, update to a version above 7.0.1 and 6.4.6. For FortiAnalyzer versions 7.0.2 and below, 6.4.7 and below, update to a version above 7.0.2 and 6.4.7. For FortiOS versions 6.2.x and 6.0.x, update to a version outside of the 6.2.x and 6.0.x range. For FortiSandbox versions 4.0.x, 3.2.x and 3.1.x, update to a version outside of the 4.0.x, 3.2.x and 3.1.x range. As a temporary workaround, consider restricting the communication between the listed products and external peers to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-297

CWE-295

Related Identifiers

CVE-2022-22305

Affected Products

Fortianalyzer

Fortimanager

Fortios

Fortisandbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22305 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22305 · Security Note
• https://fortiguard.com/psirt/FG-IR-18-292 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22305 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-18-292 · Note
• https://t.me/cibsecurity/69640 · Telegram Post