8.6

CVE-2022-26122

An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Antivirus Engine Version 0.4.23
Fortinet ≫ Antivirus Engine Version 2.0.49
Fortinet ≫ Antivirus Engine Version 2.0.60
Fortinet ≫ Antivirus Engine Version 4.4.54
Fortinet ≫ Antivirus Engine Version 6.33
Fortinet ≫ Antivirus Engine Version 6.137
Fortinet ≫ Antivirus Engine Version 6.142
Fortinet ≫ Antivirus Engine Version 6.144
Fortinet ≫ Antivirus Engine Version 6.145
Fortinet ≫ Antivirus Engine Version 6.156
Fortinet ≫ Antivirus Engine Version 6.157
Fortinet ≫ Antivirus Engine Version 6.243
Fortinet ≫ Antivirus Engine Version 6.252
Fortinet ≫ Antivirus Engine Version 6.253
Fortinet ≫ Fortimail Version >= 6.0.0 <= 6.0.12
Fortinet ≫ Fortimail Version >= 6.2.0 <= 6.2.9
Fortinet ≫ Fortimail Version >= 6.4.0 <= 6.4.6
Fortinet ≫ Fortimail Version >= 7.0.0 <= 7.0.2
Fortinet ≫ Fortimail Version 4.1.0
Fortinet ≫ FortiOS Version >= 6.0.0 <= 6.0.15
Fortinet ≫ FortiOS Version >= 6.2.0 <= 6.2.11
Fortinet ≫ FortiOS Version >= 6.4.0 <= 6.4.10
Fortinet ≫ FortiOS Version >= 7.0.0 <= 7.0.6
Fortinet ≫ FortiOS Version 7.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.379
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Fortinet 4.7 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://fortiguard.com/psirt/FG-IR-22-074
Patch
Vendor Advisory