7.4

CVE-2023-50178

An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortiadc Version >= 6.0.0 <= 6.0.4
Fortinet ≫ Fortiadc Version >= 6.1.0 <= 6.1.6
Fortinet ≫ Fortiadc Version >= 6.2.0 <= 6.2.6
Fortinet ≫ Fortiadc Version >= 7.0.0 <= 7.0.2
Fortinet ≫ Fortiadc Version >= 7.1.0 <= 7.2.3
Fortinet ≫ Fortiadc Version7.4.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.11% 0.308
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
psirt@fortinet.com 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.