Fortinet Fortiedr vulnerabilities

7 CVEs affecting Fortinet Fortiedr, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44248, published 2023-11-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-23441, published 2022-04-06. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the network to disguise as and forge messages…
CVE-2022-29057, published 2022-07-19. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0.0 allows a remote authenticated attacker…
CVE-2023-33303, published 2023-10-13. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request
CVE-2022-23446, published 2022-04-06. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive via changing its root directory access…
CVE-2022-23440, published 2022-04-06. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and…
CVE-2022-39949, published 2022-11-02. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through 5.0.3.751, 5.1.0 may allow a privileged user to terminate…
CVE-2023-44248, published 2023-11-14. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007 and below, 4.0 all may allow a local attacker to prevent the collector service…