7.5

CVE-2022-29055

A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiproxy Version >= 1.2.6 < 1.2.13
Fortinet ≫ Fortiproxy Version >= 2.0.0 < 2.0.10
Fortinet ≫ Fortiproxy Version >= 7.0.0 < 7.0.7
Fortinet ≫ Fortiproxy Version7.2.0
Fortinet ≫ Fortios Version >= 6.2.0 < 6.2.11
Fortinet ≫ Fortios Version >= 6.4.0 < 6.4.10
Fortinet ≫ Fortios Version >= 7.0.0 < 7.0.7
Fortinet ≫ Fortios Version7.2.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.21% 0.432
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
psirt@fortinet.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-824 Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.