Anti brute-force bypass in administrative interface

Anti brute-force bypass in administrative interface Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-444 Final 1 1 2023-04-11T00:00:00 Current version 2023-04-11T00:00:00 2023-04-11T00:00:00 An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiOS & FortiProxy administrative interface may allow an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions. None Improper access control FortiSwitchManager version 7.2.0 through 7.2.2FortiSwitchManager version 7.0.0 through 7.0.2FortiProxy version 7.2.0 through 7.2.1FortiProxy version 7.0.0 through 7.0.7FortiProxy 2.0 all versionsFortiProxy 1.2 all versionsFortiProxy 1.1 all versionsFortiProxy 1.0 all versionsFortiOS version 7.2.0 through 7.2.3FortiOS version 7.0.0 through 7.0.10FortiOS version 6.4.0 through 6.4.12FortiOS 6.2 all versions Please upgrade to FortiProxy version 7.2.2 or above.Please upgrade to FortiProxy version 7.0.8 or above.Please upgrade to FortiOS version 7.2.4 or above.Please upgrade to FortiOS version 7.0.11 or above.Please upgrade to FortiOS version 6.4.13 or above. Internally discovered and reported by Goutham Rukmasah from Fortinet's FortiGuard Labs . FortiOS 7.2.3 FortiOS 7.2.2 FortiOS 7.2.1 FortiOS 7.2.0 FortiOS 7.0.10 FortiOS 7.0.9 FortiOS 7.0.8 FortiOS 7.0.7 FortiOS 7.0.6 FortiOS 7.0.5 FortiOS 7.0.4 FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.12 FortiOS 6.4.11 FortiOS 6.4.10 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiOS 6.2.17 FortiOS 6.2.16 FortiOS 6.2.15 FortiOS 6.2.14 FortiOS 6.2.13 FortiOS 6.2.12 FortiOS 6.2.11 FortiOS 6.2.10 FortiOS 6.2.9 FortiOS 6.2.8 FortiOS 6.2.7 FortiOS 6.2.6 FortiOS 6.2.5 FortiOS 6.2.4 FortiOS 6.2.3 FortiOS 6.2.2 FortiOS 6.2.1 FortiOS 6.2.0 FortiProxy 7.2.1 FortiProxy 7.2.0 FortiProxy 7.0.7 FortiProxy 7.0.6 FortiProxy 7.0.5 FortiProxy 7.0.4 FortiProxy 7.0.3 FortiProxy 7.0.2 FortiProxy 7.0.1 FortiProxy 7.0.0 FortiProxy 2.0.14 FortiProxy 2.0.13 FortiProxy 2.0.12 FortiProxy 2.0.11 FortiProxy 2.0.10 FortiProxy 2.0.9 FortiProxy 2.0.8 FortiProxy 2.0.7 FortiProxy 2.0.6 FortiProxy 2.0.5 FortiProxy 2.0.4 FortiProxy 2.0.3 FortiProxy 2.0.2 FortiProxy 2.0.1 FortiProxy 2.0.0 FortiProxy 1.2.13 FortiProxy 1.2.12 FortiProxy 1.2.11 FortiProxy 1.2.10 FortiProxy 1.2.9 FortiProxy 1.2.8 FortiProxy 1.2.7 FortiProxy 1.2.6 FortiProxy 1.2.5 FortiProxy 1.2.4 FortiProxy 1.2.3 FortiProxy 1.2.2 FortiProxy 1.2.1 FortiProxy 1.2.0 FortiProxy 1.1.6 FortiProxy 1.1.5 FortiProxy 1.1.4 FortiProxy 1.1.3 FortiProxy 1.1.2 FortiProxy 1.1.1 FortiProxy 1.1.0 FortiProxy 1.0.7 FortiProxy 1.0.6 FortiProxy 1.0.5 FortiProxy 1.0.4 FortiProxy 1.0.3 FortiProxy 1.0.2 FortiProxy 1.0.1 FortiProxy 1.0.0 FortiSwitchManager 7.2.2 FortiSwitchManager 7.2.1 FortiSwitchManager 7.2.0 FortiSwitchManager 7.0.2 FortiSwitchManager 7.0.1 FortiSwitchManager 7.0.0 Anti brute-force bypass in administrative interface CVE-2022-43947 FortiOS-7.2.3 FortiOS-7.2.2 FortiOS-7.2.1 FortiOS-7.2.0 FortiOS-7.0.10 FortiOS-7.0.9 FortiOS-7.0.8 FortiOS-7.0.7 FortiOS-7.0.6 FortiOS-7.0.5 FortiOS-7.0.4 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.12 FortiOS-6.4.11 FortiOS-6.4.10 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiOS-6.2.17 FortiOS-6.2.16 FortiOS-6.2.15 FortiOS-6.2.14 FortiOS-6.2.13 FortiOS-6.2.12 FortiOS-6.2.11 FortiOS-6.2.10 FortiOS-6.2.9 FortiOS-6.2.8 FortiOS-6.2.7 FortiOS-6.2.6 FortiOS-6.2.5 FortiOS-6.2.4 FortiOS-6.2.3 FortiOS-6.2.2 FortiOS-6.2.1 FortiOS-6.2.0 FortiProxy-7.2.1 FortiProxy-7.2.0 FortiProxy-7.0.7 FortiProxy-7.0.6 FortiProxy-7.0.5 FortiProxy-7.0.4 FortiProxy-7.0.3 FortiProxy-7.0.2 FortiProxy-7.0.1 FortiProxy-7.0.0 FortiProxy-2.0.14 FortiProxy-2.0.13 FortiProxy-2.0.12 FortiProxy-2.0.11 FortiProxy-2.0.10 FortiProxy-2.0.9 FortiProxy-2.0.8 FortiProxy-2.0.7 FortiProxy-2.0.6 FortiProxy-2.0.5 FortiProxy-2.0.4 FortiProxy-2.0.3 FortiProxy-2.0.2 FortiProxy-2.0.1 FortiProxy-2.0.0 FortiProxy-1.2.13 FortiProxy-1.2.12 FortiProxy-1.2.11 FortiProxy-1.2.10 FortiProxy-1.2.9 FortiProxy-1.2.8 FortiProxy-1.2.7 FortiProxy-1.2.6 FortiProxy-1.2.5 FortiProxy-1.2.4 FortiProxy-1.2.3 FortiProxy-1.2.2 FortiProxy-1.2.1 FortiProxy-1.2.0 FortiProxy-1.1.6 FortiProxy-1.1.5 FortiProxy-1.1.4 FortiProxy-1.1.3 FortiProxy-1.1.2 FortiProxy-1.1.1 FortiProxy-1.1.0 FortiProxy-1.0.7 FortiProxy-1.0.6 FortiProxy-1.0.5 FortiProxy-1.0.4 FortiProxy-1.0.3 FortiProxy-1.0.2 FortiProxy-1.0.1 FortiProxy-1.0.0 FortiSwitchManager-7.2.2 FortiSwitchManager-7.2.1 FortiSwitchManager-7.2.0 FortiSwitchManager-7.0.2 FortiSwitchManager-7.0.1 FortiSwitchManager-7.0.0 4.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-22-444 Anti brute-force bypass in administrative interface Reference>