PT-2022-18451 · Fortinet · Fortios

Published 2022-09-06 · Updated 2022-09-09 · CVE-2022-27491

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 5.001 through 5.258 Fortinet FortiOS versions 6.001 through 6.121 Fortinet FortiOS versions 7.001 through 7.113 Fortinet FortiOS versions 7.201 through 7.214 Fortinet FortiOS versions before 4.086

Description The issue is related to an improper verification of the source of a communication channel, allowing a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests. This could potentially flood the victim. The attack is possible if at least a firewall policy has inspection mode set to flow-based and at least a Security Profile is enabled, such as Web Filter, AntiVirus, IPS, DLP, Application Control, SSL, or File filter.

Recommendations For Fortinet FortiOS versions 5.001 through 5.258, update to a version outside of this range to mitigate the risk. For Fortinet FortiOS versions 6.001 through 6.121, update to a version outside of this range to mitigate the risk. For Fortinet FortiOS versions 7.001 through 7.113, update to a version outside of this range to mitigate the risk. For Fortinet FortiOS versions 7.201 through 7.214, update to a version outside of this range to mitigate the risk. For Fortinet FortiOS versions before 4.086, update to a version 4.086 or later to mitigate the risk.

Fix

Related Identifiers

CVE-2022-27491

Affected Products

Fortios

References · 6

• https://fortiguard.com/psirt/FG-IR-22-073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27491 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27491 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27491 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-22-073 · Note
• https://usenix.org/system/files/sec21fall-bock.pdf · Note