Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2022-45862

Aug. 13, 2024, 5:11 p.m.

Tags

CWE-613
psirt@fortinet.com
2024-08-13
CVE-2022-45862

CVSS Score

3.7 / 10

Product(s) Impacted

FortiOS

  • 7.2.5 and below
  • 7.0 all versions
  • 6.4 all versions

FortiProxy

  • 7.2 all versions
  • 7.0 all versions

FortiPAM

  • 1.3 all versions
  • 1.2 all versions
  • 1.1 all versions
  • 1.0 all versions

FortiSwitchManager

  • 7.2.1 and below
  • 7.0 all versions

Description

An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.

Weaknesses

CWE-613
Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

CWE ID: 613

Date

Published: Aug. 13, 2024, 4:15 p.m.

Last Modified: Aug. 13, 2024, 5:11 p.m.

Status : Undergoing Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

psirt@fortinet.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score
3.7
Exploitability Score
2.2
Impact Score
1.4
Base Severity
LOW
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://fortiguard.com/ psirt@fortinet.com