CVE-2022-45861: Access of NULL pointer in SSLVPNd
An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.
Other sources
An access of uninitialized pointer vulnerability [CWE-824] in the SSL-VPN portal of FortiOS & FortiProxy may allow a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-45861?
CVE-2022-45861 is an access of uninitialized pointer vulnerability in the SSL VPN portal of Fortinet FortiOS and FortiProxy.
What is the severity of CVE-2022-45861?
CVE-2022-45861 has a severity level of 6.5 (medium).
Which software versions are affected by CVE-2022-45861?
Fortinet FortiOS versions 6.4.0 through 6.4.11, 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3, as well as FortiProxy versions 2.0.0 through 2.0.11, 7.0.0 through 7.0.7, and 7.2.0 through 7.2.1 are affected by CVE-2022-45861.
How does CVE-2022-45861 impact Fortinet FortiOS?
CVE-2022-45861 can be exploited by a remote authenticated attacker to gain unauthorized access to sensitive information or execute arbitrary code on affected versions of Fortinet FortiOS.
How can I fix CVE-2022-45861?
To fix CVE-2022-45861, it is recommended to update Fortinet FortiOS and FortiProxy to the latest available versions provided by Fortinet.