CVE-2022-22305 — Improper Validation of Certificate with Host Mismatch in Fortinet Fortianalyzer

CWE-297 — Improper Validation of Certificate with Host Mismatch CWE-295 — Improper Certificate Validation4 documents4 sources

Severity

4.2MEDIUMNVD

CNA5.4

EPSS

0.1%

top 84.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortianalyzer Fortinet Fortimanager Fortinet Fortisandbox +1 more

Timeline

PublishedSep 1

Description

An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 1.6 | Impact: 2.5

Affected Packages7 packages

▶NVDfortinet/fortios5.6.10 — 5.6.14+2

▶CVEListV5fortinet/fortimanager7.0.0 — 7.0.1+3

▶CVEListV5fortinet/fortisandbox4.0.0 — 4.0.2+3

▶NVDfortinet/fortimanager6.0.0 — 6.0.12+4

▶NVDfortinet/fortisandbox3.0.0 — 3.0.7+6

🔴Vulnerability Details

CVEList

CVE-2022-22305: An improper certificate validation vulnerability [CWE-295] in FortiManager 7↗2023-09-01

▶

GHSA

GHSA-r4mc-2xrg-97hv: An improper certificate validation vulnerability [CWE-295] in FortiManager 7↗2023-09-01

▶

📋Vendor Advisories

Fortinet

Lack of certificate verification when establishing secure connections↗2023-09-01

▶