CVE-2022-29055

published 2022-10-18

CVE-2022-29055: A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortios	—	—
fortinet	fortios	—	—
fortinet	fortios	>= 6.2.0 < 6.2.11	6.2.11
fortinet	fortios	>= 6.4.0 < 6.4.10	6.4.10
fortinet	fortios	>= 7.0.0 < 7.0.7	7.0.7
fortinet	fortiproxy	—	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	>= 1.2.6 < 1.2.13	1.2.13
fortinet	fortiproxy	>= 2.0.0 < 2.0.10	2.0.10
fortinet	fortiproxy	>= 7.0.0 < 7.0.7	7.0.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-824