← Back

CVE-2022-40684

nvd nistnuclei
Published: Oct 18, 2022Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Affected (6)

Fortinet
3 products
Fortios
Fortiproxy
Fortiswitchmanager
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 7.0.0 to 7.0.7
Fortios
From 7.2.0 to 7.2.2
Fortinet
Fortiproxy
From 7.0.0 to 7.0.7
Fortiproxy
Version 7.2.0
Fortinet
Fortiswitchmanager
Version 7.0.0
Fortiswitchmanager
Version 7.2.0

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (7)

Source: psirt@fortinet.com
ExploitThird Party AdvisoryVDB Entry
Source: psirt@fortinet.com
ExploitThird Party AdvisoryVDB Entry
Source: psirt@fortinet.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.