{
  "id": "cve-2022-40684",
  "cveID": "CVE-2022-40684",
  "vendor": "Fortinet",
  "product": "Multiple Products",
  "vulnerabilityName": "Fortinet Multiple Products Authentication Bypass Vulnerability",
  "shortDescription": "Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.",
  "requiredAction": "Apply updates per vendor instructions.",
  "dateAdded": "2022-10-11",
  "dueDate": "2022-11-01",
  "knownRansomware": true,
  "cwes": [
    "CWE-288"
  ],
  "notes": "https://www.fortiguard.com/psirt/FG-IR-22-377;  https://nvd.nist.gov/vuln/detail/CVE-2022-40684",
  "sources": [
    {
      "label": "NVD",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40684"
    },
    {
      "label": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    },
    {
      "label": "fortiguard.com",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-377"
    },
    {
      "label": "nvd.nist.gov",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40684"
    }
  ],
  "cvss": {
    "score": 9.8,
    "severity": "CRITICAL",
    "version": "3.1",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "epss": {
    "score": 0.99984,
    "percentile": 0.99982
  },
  "timeline": [
    {
      "date": "2022-10-11",
      "event": "Added to the CISA KEV catalog"
    },
    {
      "date": "2022-11-01",
      "event": "CISA remediation due date (BOD 22-01)"
    }
  ],
  "status": "past due"
}