CVE-2022-41331 - A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests

Back Back to CVE browser

CRITICAL

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests

Published Apr 11, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.27%

Description

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

Affected products

Vendor Fortinet Product FortiPresence Default
unaffected
- Version
  1.0.0
  Status
  affected
  Constraints
  -
- Version
  1.1.0
  Status
  affected
  Constraints
  <=1.1.1
- Version
  1.2.0
  Status
  affected
  Constraints
  <=1.2.1