PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)

horizon3.ai | vulnerability | CVE-2022-40684 | #vulnerability-research | #fortinet | #fortios | #auth-bypass | #horizon3
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Fortinet recently patched a critical authentication bypass vulnerability that gives an attacker the ability to login as an administrator,
CVE
CVE-2022-40684
Published
Collected

Related coverage

vulnerability · horizon3.ai
FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass IOCs (CVE-2022-40684)
# FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass IOCs (CVE-2022-40684) James Horseman October 11, 2022 Attack Blogs ## Introduction The recent FortiOS / FortiProxy /...
vulnerability · yokai.hakaisecurity.io
Fortigate - Authentication Bypass Lead to Full Device Takeover
1Day vulnerability research by Hakai – Research Team This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability [CWE-288]. Timeline 07/10/2022 – First news about the vulnerability, on 10/07/2022 Gi7w0rm tweeted that Fortinet was […]
vulnerability · yokai.hakaisecurity.io
Fortigate - Autenticação de Desvio Levando à Assunção Completa do Dispositivo
Pesquisa de vulnerabilidade 1Day pela Equipe de Pesquisa da Hakai Este post trata da jornada para criar uma Prova de Conceito sobre a CVE-2022-40684, esta vulnerabilidade foi atribuída pela Fortinet como uma falha de autenticação usando uma vulnerabilidade de caminho ou canal alternativo [CWE-288]. Linha do Tempo 07/10/2022 – Primeira notícia sobre a vulnerabilidade, […]
vulnerability · horizon3.ai
VMware Authentication Bypass Vulnerability (CVE-2022-22972) Technical Deep Dive
Technical deep dive into VMware’s recently patched authentication bypass vulnerability allowing an attacker to login as any known local user.
vulnerability · horizon3.ai
[CVE-2022-1388] F5 iControl REST Endpoint Authentication Bypass Technical Deep Dive
F5 recently patched a critical vulnerability in their BIG-IP iControl REST endpoint CVE-2022-1388. It is simple to exploit and provides an attacker with a method to execute arbitrary system commands.
vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
Back