An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all versions, 7.0 all versions, 7.2.0 and FortiClientiOS 5.6 all versions, 6.0.0 through 6.0.1, 7.0.0 through 7.0.6 SAML SSO feature may allow an unauthenticated attacker to man-in-the-middle the communication between the FortiClient and both the service provider and the identity provider.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-22-230 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
26 Sep 2024, 14:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-22-230 - Vendor Advisory | |
| First Time |
Fortinet forticlient
Fortinet |
|
| Summary |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
| CPE | cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:mac_os:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:iphone_os:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:android:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:* |
10 Sep 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-10 15:15
Updated : 2024-09-26 14:48
NVD link : CVE-2022-45856
Mitre link : CVE-2022-45856
CVE.ORG link : CVE-2022-45856
JSON object : View
Products Affected
fortinet
- forticlient
CWE
CWE-295
Improper Certificate Validation