CVEvulnerability

CVE-2022-26122

8.6 HIGH Published 2022-11-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-345

Description

An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.

Affected configurations

• fortinet antivirus engine 0.4.23 • fortinet antivirus engine 2.0.49 • fortinet antivirus engine 2.0.60 • fortinet antivirus engine 4.4.54 • fortinet antivirus engine 6.33 • fortinet antivirus engine 6.137 • fortinet antivirus engine 6.142 • fortinet antivirus engine 6.144 • fortinet antivirus engine 6.145 • fortinet antivirus engine 6.156 • fortinet antivirus engine 6.157 • fortinet antivirus engine 6.243 • fortinet antivirus engine 6.252 • fortinet antivirus engine 6.253 • fortinet fortimail (>= 6.0.0 <= 6.0.12) • fortinet fortimail (>= 6.2.0 <= 6.2.9) • fortinet fortimail (>= 6.4.0 <= 6.4.6) • fortinet fortimail (>= 7.0.0 <= 7.0.2) • fortinet fortimail 4.1.0 • fortinet fortios (>= 6.0.0 <= 6.0.15) • fortinet fortios (>= 6.2.0 <= 6.2.11) • fortinet fortios (>= 6.4.0 <= 6.4.10) • fortinet fortios (>= 7.0.0 <= 7.0.6) • fortinet fortios 7.2.0

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References