CVE-2022-45860 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2022-45860

Modified

More Info Official Page

Source-psirt@fortinet.com

Published At-03 May, 2023 | 22:15

Updated At-07 Nov, 2023 | 03:54

A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CPE Matches

>>fortinac>>Versions from 8.7.0(inclusive) to 9.2.6(inclusive)

cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*

>>fortinac>>Versions from 9.4.0(inclusive) to 9.4.2(exclusive)

cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*

>>fortinac-f>>7.2.0

cpe:2.3:a:fortinet:fortinac-f:7.2.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-287	Primary	nvd@nist.gov
CWE-1390	Secondary	psirt@fortinet.com

CWE ID: CWE-287

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-1390

Type: Secondary

Source: psirt@fortinet.com

References

Hyperlink	Source	Resource
https://fortiguard.com/psirt/FG-IR-22-464	psirt@fortinet.com	Vendor Advisory

Hyperlink: https://fortiguard.com/psirt/FG-IR-22-464

Source: psirt@fortinet.com

Resource:

Vendor Advisory