{"basis":"claimed","id":"CVE-2022-40684","name":"Fortinet Multiple Products Authentication Bypass Vulnerability","vendorProject":"Fortinet","product":"Multiple Products","publishedAt":"2022-10-18","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2022-10-11","dueDate":"2022-11-01","ransomware":true},"epss":{"score":0.99984,"percentile":0.99983,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-02-11","daysToRule":847},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","cwes":["CWE-288"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-02-11","firstIsNew":true,"daysToRule":847,"daysAtMost":null,"freePlan":false,"claims":[{"id":"81d3438c97339d9e888fa9ff1c79cb04773a0452f9318410f0434b3490509fe0","cve_id":"CVE-2022-40684","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"05842b06f0a4415880b58f7fbf72cf8a","rule_name":"FortiOS - Auth Bypass - CVE:CVE-2022-40684","change":"new","default_action":"Block","published_on":"2025-02-11","source_url":"https://developers.cloudflare.com/changelog/post/2025-02-11-waf-release/","source_title":"WAF Release - 2025-02-11","excerpt":"FortiOS - Auth Bypass - CVE:CVE-2022-40684. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.956Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:44.320Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"partial","templateId":"CVE-2022-40684","templatePath":"http/cves/2022/CVE-2022-40684.yaml","requests":2,"blockedRequests":1,"rules":["911100"],"note":"","requestDetail":[{"method":"GET","path":"/api/v2/cmdb/system/admin","status":200,"blocked":false,"rules":[]},{"method":"PUT","path":"/api/v2/cmdb/system/admin/admin","status":403,"blocked":true,"rules":["911100"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"partial","templateId":"CVE-2022-40684","templatePath":"http/cves/2022/CVE-2022-40684.yaml","requests":2,"blockedRequests":1,"rules":["911100"],"note":"","requestDetail":[{"method":"GET","path":"/api/v2/cmdb/system/admin","status":200,"blocked":false,"rules":[]},{"method":"PUT","path":"/api/v2/cmdb/system/admin/admin","status":403,"blocked":true,"rules":["911100"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}