CVE-2022-41331

published 2023-04-11

CVE-2022-41331: A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortipresence	—	—
fortinet	fortipresence	—	—
fortinet	fortipresence	1.1.0 – 1.1.1	—
fortinet	fortipresence	1.2.0 – 1.2.1	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	>= 1.0.0 < 2.0.0	2.0.0

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for unauthenticated access attempts to Redis and MongoDB instances exposed by FortiPresence infrastructure server, which may indicate exploitation of CVE-2022-41331 ↗
• → Flag any authentication requests to FortiPresence infrastructure server (versions before 1.2.1) that bypass normal authentication flows, particularly those targeting backend Redis or MongoDB services ↗

• · Vulnerability affects FortiPresence infrastructure server versions before 1.2.1; ensure patching to 1.2.1 or later to remediate the missing authentication control on Redis and MongoDB instances ↗
• · The vulnerability is classified CWE-306 (Missing Authentication for Critical Function) with a CVSS score of 9.8 (Critical), meaning Redis and MongoDB backend services are reachable without authentication by any remote attacker ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306