Riskcovery

CVE-2022-45856

State
Published
Severity
4.6 Medium
Published
Sep 10, 2024
Updated
Sep 10, 2024
Reserved
Nov 23, 2022

Read the record on cve.org

Description

An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all versions, 7.0 all versions, 7.2.0 and FortiClientiOS 5.6 all versions, 6.0.0 through 6.0.1, 7.0.0 through 7.0.6 SAML SSO feature may allow an unauthenticated attacker to man-in-the-middle the communication between the FortiClient and  both the service provider and the identity provider.

Scores

CVSSScoreVectorSource
3.14.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:Cfortinet

Weaknesses

Affected Products

ProductVersions
FortiClientiOSFortinet
  • 7.0.3 through 7.0.6Affected
  • 7.0.0 through 7.0.1Affected
  • 6.0.0 through 6.0.1Affected
  • 5.6.5 through 5.6.6Affected
  • 5.6.0 through 5.6.1Affected
  • 5.4.3 through 5.4.4Affected
  • 5.4.0 through 5.4.1Affected
  • 5.2.0 through 5.2.3Affected
  • 5.0.0 through 5.0.3Affected
  • 4.0.0 through 4.0.2Affected
  • 2.0.0 through 2.0.1Affected
FortiClientAndroidFortinet
  • 7.2.0Affected
  • 7.0.6 through 7.0.7Affected
  • 7.0.2 through 7.0.3Affected
  • 7.0.0Affected
  • 6.4.6Affected
  • 6.4.4Affected
  • 6.4.1Affected
  • 6.0.0Affected
  • 5.6.0Affected
  • 5.4.0 through 5.4.2Affected
  • 5.2.0 through 5.2.8Affected
  • 5.0.0 through 5.0.3Affected
FortiClientMacFortinet
  • 7.2.0 through 7.2.4Affected
  • 7.0.0 through 7.0.13Affected
  • 6.4.0 through 6.4.10Affected
FortiClientLinuxFortinet
  • 7.2.0 through 7.2.4Affected
  • 7.0.0 through 7.0.13Affected
  • 6.4.7 through 6.4.9Affected
  • 6.4.0 through 6.4.4Affected
FortiClientWindowsFortinet
  • 7.0.0 through 7.0.7Affected
  • 6.4.0 through 6.4.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.