PT-2023-7425 · Fortinet · Fortiproxy+1

Published 2023-04-11 · Updated 2023-04-18 · CVE-2022-43947

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.2.0 through 7.2.3 FortiOS versions prior to 7.0.10 FortiProxy versions 7.2.0 through 7.2.2 FortiProxy versions prior to 7.0.8

Description The issue is related to an improper restriction of excessive authentication attempts in the administrative interface of FortiOS and FortiProxy, allowing an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions.

Recommendations For FortiOS versions 7.2.0 through 7.2.3, update to a version that includes the fix for this issue. For FortiOS versions prior to 7.0.10, update to a version that includes the fix for this issue. For FortiProxy versions 7.2.0 through 7.2.2, update to a version that includes the fix for this issue. For FortiProxy versions prior to 7.0.8, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the administrative interface to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2023-08462

CVE-2022-43947

Affected Products

Fortios

Fortiproxy

References · 5

• https://fortiguard.com/psirt/FG-IR-22-444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43947 · Security Note
• https://bdu.fstec.ru/vul/2023-08462 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43947 · Vendor Advisory
• https://t.me/cibsecurity/61890 · Telegram Post