« Volver al listado

CVE-2015-2323

Estado: ModificadaMedia (6.4)—

FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortios

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2323",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-11T14:59:01.807",
  "references": [
    {
      "url": "http://fortiguard.com/advisory/2015-07-24-weak-ciphers-suites-are-presented-towards-fortiguard-servers",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.fortiguard.com/advisory/FG-IR-15-021/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1033092",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://fortiguard.com/advisory/2015-07-24-weak-ciphers-suites-are-presented-towards-fortiguard-servers",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.fortiguard.com/advisory/FG-IR-15-021/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033092",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en FortiOS 5.0.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.4 admite el anonimato, exportación, RC4 y posiblemente otros cifrados débiles al utilizar TLS para conectarse a los servidores de FortiGuard, lo que permite a atacantes man-in-the-middle suplantar contenido TLS mediante la modificación de los paquetes."
    }
  ],
  "lastModified": "2026-06-17T00:23:55.433",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E542BE2-14FC-4BA8-890C-7DA81F33F032"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D8A5EC4-CE2C-4174-9F09-361B8D153AD9"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3BABC91-F9BF-4B52-BDBF-F9617ABCAC9F"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C172379-F6BA-4343-831A-62004E742C6D"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516597D9-086E-4668-A40B-473F38125F92"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D62F480B-D8CA-4F5C-8034-C0AE73F26B67"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F435F408-EC5B-42A0-9E3C-4DE5D702ACAE"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "823C8357-E638-4EAE-B231-3B60263FFE52"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6615C7-C6F8-4E42-BA09-5A29A0B68E09"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B24C5917-BBC0-4924-9FB0-49E141DC9D54"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "513A1CAA-9B87-4CF5-9513-396E2E686CDF"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62CD94B3-C430-4672-BBEA-B8A542944F66"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E627C59-7C16-44F0-800D-A2E8A766B26D"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "233236FA-BB13-4261-BE2E-3E617406DC53"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27844CC9-498B-4A65-91AC-AC130222EE5F"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27B4C672-7ED5-4113-87AE-5774D1263C0B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}