PT-2022-5759 · Fortinet · Fortisiem

Published 2022-11-01 · Updated 2023-08-08 · CVE-2022-26119

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiSIEM versions prior to 6.5.0

Description The issue is related to improper authentication in Fortinet FortiSIEM, allowing a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password. This is due to weaknesses in the authentication procedure and the use of default credentials when connecting to the Glassfish server. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information.

Recommendations For Fortinet FortiSIEM versions prior to 6.5.0, update to version 6.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CLI and the Glassfish server to minimize the risk of exploitation. Avoid using default credentials for the Glassfish server connection until the issue is resolved.

Fix

Improper Authentication

Using Hardcoded Credentials

Weakness Enumeration

CWE-287

CWE-798

Related Identifiers

BDU:2022-07158

CVE-2022-26119

Affected Products

Fortisiem

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-26119 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07158 · Security Note
• https://t.me/echeloneyes/850 · Telegram Post