CVE-2022-26115
published 2023-02-16CVE-2022-26115: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.32%
23.5th percentile
A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | 3.2.0 – 3.2.3 | — |
| fortinet | fortisandbox | 4.0.0 – 4.0.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
Improper password storage mechanism
vendor_fortinet·2023-02-16·CVSS 5.9
CVE-2022-26115 [MEDIUM] CWE-916 Improper password storage mechanism
FG-IR-20-220: Improper password storage mechanism
A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
CVEs: CVE-2022-26115
CWEs: CWE-916
CVSS: 5.9 (medium)
Affected products: FortiSandbox
GHSA
GHSA-335q-v5r7-xq5p: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4
ghsa_unreviewed·2023-02-16
CVE-2022-26115 [HIGH] CWE-916 GHSA-335q-v5r7-xq5p: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4
A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-16
Published