CVE-2022-43947
First published: Tue Apr 11 2023(Updated: )
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=1.0.0<=2.0.9 | |
| Fortinet FortiProxy | >=7.0.0<7.0.8 | |
| Fortinet FortiProxy | >=7.2.0<7.2.2 | |
| Fortinet FortiOS | >=6.2.0<6.4.13 | |
| Fortinet FortiOS | >=7.0.0<7.0.11 | |
| Fortinet FortiOS | >=7.2.0<7.2.4 |
Remedy
Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above Please upgrade to FortiOS version 7.2.4 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiOS version 6.4.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-43947?
CVE-2022-43947 is an improper restriction of excessive authentication attempts vulnerability in Fortinet FortiOS and FortiProxy.
What is the severity of CVE-2022-43947?
The severity of CVE-2022-43947 is high with a CVSS score of 8.8.
Which products are affected by CVE-2022-43947?
Fortinet FortiOS versions 7.2.0 through 7.2.3 and before 7.0.10, and FortiProxy versions 7.2.0 through 7.2.2 and before 7.0.8 are affected.
How does CVE-2022-43947 impact Fortinet FortiProxy?
CVE-2022-43947 allows an attacker with a valid user account to perform brute-force attacks on the FortiProxy administrative interface.
How can I fix CVE-2022-43947?
Update Fortinet FortiOS to version 7.0.10 or later, and update FortiProxy to version 7.0.8 or later to mitigate the vulnerability.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/1.0.0
- version/fortinet fortiproxy/2.0.9
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.2.0
- canonical/fortinet fortios
- version/fortinet fortios/6.2.0
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.2.0