Insufficient Data Verification in Fortinet’s FortiClient, FortiMail, and FortiOS Products
CVE-2022-26122

4.7MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Av Engine, Fortimail, FortiOS, Forticlient
Vendor
CVE Published:
2 November 2022

Summary

Fortinet has identified a vulnerability within its FortiClient, FortiMail, and FortiOS products that stems from inadequate verification of data authenticity. This flaw can be exploited by attackers who manipulate MIME attachments by introducing junk and pad characters in base64 encoding. As a result, the affected AV engines, specifically versions 6.2.168 and below, and 6.4.274 and below, may be circumvented, allowing potential unauthorized actions and data breaches. Users are urged to review the impact of this vulnerability and take appropriate measures.

Affected Version(s)

Fortinet AV Engine, FortiMail, FortiOS, FortiClient AV Engine version 6.2.168 and below and version 6.4.274 and below.

References

https://fortiguard.com/psirt/FG-IR-22-074

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.