CVE-2022-43947
At a glance Severity MEDIUM 4.7 EPSS EPSS 0.40 % · percentile 35 (2026-10-27) State PUBLISHED Published 2023-04-11 Updated 2024-10-22 Assigner fortinet NVD status Modified Description An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C fortinet CVSS 3.1 MEDIUM 5.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L NVD · psirt@fortinet.com (Secondary) CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.0.0 ≤ 2.0.9cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.2cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.4.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.4Affected products Product Versions Fortinet · FortiOS affected 7.2.0 ≤ 7.2.3 ; affected 7.0.0 ≤ 7.0.10 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.13 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.1 ; affected 7.0.0 ≤ 7.0.7 ; affected 2.0.0 ≤ 2.0.12 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6 ; affected 1.0.0 ≤ 1.0.7
References
Sources
