9.8

CVE-2022-35843

An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0,  7.0.0 through 7.0.7,  6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiproxy Version >= 1.2.0 <= 1.2.13
Fortinet ≫ Fortiproxy Version >= 2.0.0 <= 2.0.10
Fortinet ≫ Fortiproxy Version >= 7.0.0 <= 7.0.6
Fortinet ≫ Fortios Version >= 6.0.0 <= 6.0.15
Fortinet ≫ Fortios Version >= 6.2.0 <= 6.2.12
Fortinet ≫ Fortios Version >= 6.4.0 <= 6.4.9
Fortinet ≫ Fortios Version >= 7.0.0 <= 7.0.7
Fortinet ≫ Fortios Version7.2.0
Fortinet ≫ Fortios Version7.2.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.227
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
psirt@fortinet.com 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.