PT-2023-12861 · Fortinet · Fortisandbox

Published 2023-02-16 · Updated 2023-02-24 · CVE-2022-26115

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 4.2.0

Description The issue is related to the use of password hash with insufficient computational effort, allowing an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

Recommendations For versions prior to 4.2.0, update to version 4.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the password database to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2022-26115

Affected Products

Fortisandbox

References · 4

• https://fortiguard.com/psirt/FG-IR-20-220 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26115 · Security Note
• https://t.me/cibsecurity/58382 · Telegram Post