{"id":"CVE-2022-29056","state":"PUBLISHED","title":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows  a remo","description":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.","publishedAt":"2023-03-09T14:54:52.009Z","updatedAt":"2024-10-22T20:48:02.279Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiMail"],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected"},{"version":"6.2.1","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.9","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.12","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-20-078"],"weaknesses":["CWE-307"],"ingestedAt":"2026-10-29T19:49:57.813Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/29xxx/CVE-2022-29056.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-29056","state":"PUBLISHED","datePublished":"2023-03-09T14:54:52.009Z","dateUpdated":"2024-10-22T20:48:02.279Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-04-11T13:56:39.869Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form."}],"affected":[{"vendor":"Fortinet","product":"FortiMail","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected"},{"version":"6.2.1","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.9","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.12","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-078","name":"https://fortiguard.com/psirt/FG-IR-20-078"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-307","lang":"en","description":"Denial of service","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-03-09T14:54:52.009Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiAuthenticator version 6.5.0 or above,\nPlease upgrade to FortiDeceptor version 3.2.0 or above.\nPlease upgrade to FortiMail version 6.4.1 or above,\r\nPlease upgrade to FortiMail version 6.2.5 or above,\r\nPlease upgrade to FortiMail version 6.0.10 or above."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-078","name":"https://fortiguard.com/psirt/FG-IR-20-078","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T06:10:58.728Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T20:18:21.685042Z","id":"CVE-2022-29056","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T20:48:02.279Z"}}]}}}