CVE-2022-41331

published 2023-04-11

CVE-2022-41331: A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortipresence	—	—
fortinet	fortipresence	—	—
fortinet	fortipresence	1.1.0 – 1.1.1	—
fortinet	fortipresence	1.2.0 – 1.2.1	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	>= 1.0.0 < 2.0.0	2.0.0

CWE-306