CVE-2022-26122 : An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engin

An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.

Published 2022-11-02 12:15:53

Updated 2022-11-04 13:20:04

Source Fortinet, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-26122

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-26122

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N	3.9	4.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: None
4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	2.8	1.4	Fortinet, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: None Integrity: Low Availability: None

Products affected by CVE-2022-26122

Fortinet » Fortios
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.15
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.4.0 and up to, including, (<=) 6.4.10
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.2.0 and up to, including, (<=) 6.2.11
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.6
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios » Version: 7.2.0
cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimail
Versions from including (>=) 6.4.0 and up to, including, (<=) 6.4.6
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimail
Versions from including (>=) 6.2.0 and up to, including, (<=) 6.2.9
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimail
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.2
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimail
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.12
cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimail » Version: 4.1.0
cpe:2.3:a:fortinet:fortimail:4.1.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.33
cpe:2.3:a:fortinet:antivirus_engine:6.33:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.253
cpe:2.3:a:fortinet:antivirus_engine:6.253:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.252
cpe:2.3:a:fortinet:antivirus_engine:6.252:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.243
cpe:2.3:a:fortinet:antivirus_engine:6.243:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.157
cpe:2.3:a:fortinet:antivirus_engine:6.157:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.156
cpe:2.3:a:fortinet:antivirus_engine:6.156:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.145
cpe:2.3:a:fortinet:antivirus_engine:6.145:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.144
cpe:2.3:a:fortinet:antivirus_engine:6.144:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.142
cpe:2.3:a:fortinet:antivirus_engine:6.142:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 6.137
cpe:2.3:a:fortinet:antivirus_engine:6.137:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 4.4.54
cpe:2.3:a:fortinet:antivirus_engine:4.4.54:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 2.0.60
cpe:2.3:a:fortinet:antivirus_engine:2.0.60:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 2.0.49
cpe:2.3:a:fortinet:antivirus_engine:2.0.49:*:*:*:*:*:*:*
Matching versions
Fortinet » Antivirus Engine » Version: 0.4.23
cpe:2.3:a:fortinet:antivirus_engine:0.4.23:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-26122

Exploit prediction scoring system (EPSS) score for CVE-2022-26122

CVSS scores for CVE-2022-26122

CWE ids for CVE-2022-26122

References for CVE-2022-26122

Products affected by CVE-2022-26122