CVE-2023-22642

HIGH

FortiAnalyzer & FortiManager 6.4.8-6.4.10, 7.0.0-7.0.5, 7.2.0-7.2.1 - MITM via Improper Cert Validation

Title source: llm

Description

An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-502

Scores

CVSS v3 7.5

EPSS 0.0020

EPSS Percentile 42.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-295

Status published

Products (2)

fortinet/fortianalyzer 6.4.8 - 6.4.11

fortinet/fortimanager 6.4.8 - 6.4.11

Published Apr 11, 2023

Tracked Since Feb 18, 2026