5.3

CVE-2012-4948

The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortigate-1000c Version-
Fortinet ≫ Fortigate-100d Version-
Fortinet ≫ Fortigate-110c Version-
Fortinet ≫ Fortigate-1240b Version-
Fortinet ≫ Fortigate-200b Version-
Fortinet ≫ Fortigate-20c Version-
Fortinet ≫ Fortigate-300c Version-
Fortinet ≫ Fortigate-3040b Version-
Fortinet ≫ Fortigate-310b Version-
Fortinet ≫ Fortigate-311b Version-
Fortinet ≫ Fortigate-3140b Version-
Fortinet ≫ Fortigate-3240c Version-
Fortinet ≫ Fortigate-3810a Version-
Fortinet ≫ Fortigate-3950b Version-
Fortinet ≫ Fortigate-40c Version-
Fortinet ≫ Fortigate-5001b Version-
Fortinet ≫ Fortigate-5020 Version-
Fortinet ≫ Fortigate-5060 Version-
Fortinet ≫ Fortigate-50b Version-
Fortinet ≫ Fortigate-5101c Version-
Fortinet ≫ Fortigate-5140b Version-
Fortinet ≫ Fortigate-600c Version-
Fortinet ≫ Fortigate-60c Version-
Fortinet ≫ Fortigate-620b Version-
Fortinet ≫ Fortigate-800c Version-
Fortinet ≫ Fortigate-80c Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.09% 0.265
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.2 7.8
AV:A/AC:H/Au:N/C:C/I:P/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

http://www.kb.cert.org/vuls/id/111708
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/56382
Third Party Advisory
VDB Entry