What is CVE-2022-45861?

CVE-2022-45861 is a medium-severity vulnerability in Fortinet Fortios, classified under Access of Uninitialized Pointer. CVSS score: 6.5/10. Published 2023-03-07.

How severe is CVE-2022-45861?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Fortinet Fortios

CVE-2022-45861

An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

EPSS: 0.008 (53.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Fortinet Fortios — versions 7.2.0, 7.0.0, 6.4.0
Fortinet Fortiproxy — versions 1.1.6, 7.0.0, 7.2.1

Weakness classification (CWE)

CWE-824 — Access of Uninitialized Pointer

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2022-45861?: CVE-2022-45861 is a medium-severity vulnerability in Fortinet Fortios, classified under Access of Uninitialized Pointer. CVSS score: 6.5/10. Published 2023-03-07.
How severe is CVE-2022-45861?: Medium severity. CVSS v3 base score is 6.5 out of 10.