CVE-2022-42478

Published: Jun 13, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints.

Affected (25)

Products: Fortinet: Fortisiem

Fortinet

1 product

Fortisiem

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortisiem	From 5.1.0 to 5.1.3
Fortinet Fortisiem	From 5.3.0 to 5.3.3
Fortinet Fortisiem	From 6.3.0 to 6.3.3
Fortinet Fortisiem	Version 5.2.1
Fortinet Fortisiem	Version 5.2.2
Fortinet Fortisiem	Version 5.2.5
Fortinet Fortisiem	Version 5.2.6
Fortinet Fortisiem	Version 5.2.7
Fortinet Fortisiem	Version 5.2.8
Fortinet Fortisiem	Version 5.4.0
Fortinet Fortisiem	Version 6.1.0
Fortinet Fortisiem	Version 6.1.1
Fortinet Fortisiem	Version 6.1.2
Fortinet Fortisiem	Version 6.2.0
Fortinet Fortisiem	Version 6.2.1
Fortinet Fortisiem	Version 6.4.0
Fortinet Fortisiem	Version 6.4.1
Fortinet Fortisiem	Version 6.4.2
Fortinet Fortisiem	Version 6.5.0
Fortinet Fortisiem	Version 6.5.1
Fortinet Fortisiem	Version 6.6.0
Fortinet Fortisiem	Version 6.6.1
Fortinet Fortisiem	Version 6.6.2
Fortinet Fortisiem	Version 6.6.3
Fortinet Fortisiem	Version 6.7.0

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://fortiguard.com/psirt/FG-IR-22-258

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-258

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.