CVE-2022-27491
Medium
Description
A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Fortinet Fortios
PublishedSep 6, 2022
First seenSep 6, 2022
How to fix
Update
- fortinet fortios6.2.11, 6.4.9, 7.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortios | 6.0.0 ≤ v ≤ 6.0.14, 6.2.0 ≤ v < 6.2.11, 6.4.0 ≤ v < 6.4.9, 7.0.0 ≤ v < 7.0.6, 7.2.0 | 6.2.11, 6.4.9, 7.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.