An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.
Una vulnerabilidad de validación de certificado incorrecta [CWE-295] en FortiOS versión 7.6.1 y anteriores, versión 7.4.7 y anteriores puede permitir que un usuario remoto verificado por EAP se conecte desde FortiClient a través de un certificado revocado.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-295
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| fortinet | fortisase | 25.1.39 | <built-in method update of dict object at 0x7d1e5fec8500> | Application |
| fortinet | fortios | * | <built-in method update of dict object at 0x7d1e5da50440> | Operating System |
| fortinet | fortios | * | <built-in method update of dict object at 0x7d1e5fec86c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:* |
| Yes | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |