CVE-2022-29060: High severity fortinet fortiddos-f vulnerability

Published Jul 18, 2022

Updated

A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device.

Affected Software

9 affected components

Fortinet FortiDDoS=5.1.0

Fortinet FortiDDoS=5.2.0

Fortinet FortiDDoS=5.3.0

Fortinet FortiDDoS=5.3.1

Fortinet FortiDDoS=5.4.0

Fortinet FortiDDoS=5.4.1

Fortinet FortiDDoS=5.4.2

Fortinet FortiDDoS=5.5.0

Fortinet FortiDDoS=5.5.1

Remediation

Patch Available

https://fortiguard.com/psirt/FG-IR-22-071

Event History

Jul 18, 2022

CVE Published

via MITRE·04:35 PM

Data Sourced

via MITRE·04:35 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-29060?

CVE-2022-29060 is a vulnerability that allows an attacker who managed to retrieve a hard-coded cryptographic key from a FortiDDoS device to sign JWT tokens for any device.

Which versions of FortiDDoS API are affected by CVE-2022-29060?

FortiDDoS API versions 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, and 5.1.0 are affected by CVE-2022-29060.

What is the severity of CVE-2022-29060?

CVE-2022-29060 has a severity rating of 8.1 (high).

How can an attacker exploit CVE-2022-29060?

An attacker can exploit CVE-2022-29060 by retrieving the hard-coded cryptographic key from a vulnerable FortiDDoS device and using it to sign JWT tokens for any device.

Is there a fix for CVE-2022-29060?

To fix CVE-2022-29060, it is recommended to update FortiDDoS API to a version that is not affected by the vulnerability.