CVE-2022-26122

4.7MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Av Engine, Fortimail, FortiOS, Forticlient
Vendor
CVE Published:
2 November 2022

Summary

An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.

Affected Version(s)

Fortinet AV Engine, FortiMail, FortiOS, FortiClient AV Engine version 6.2.168 and below and version 6.4.274 and below.

References

https://fortiguard.com/psirt/FG-IR-22-074

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.