CVE-2023-22641: Open redirect in sslvpnd
A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.
Other sources
A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiOS and FortiProxy sslvpnd may allow an authenticated attacker to redirect users to any arbitrary website via a crafted URL.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-22641.
What is the severity level of CVE-2023-22641?
The severity level of CVE-2023-22641 is medium with a score of 5.4.
Which versions of Fortinet FortiOS and FortiProxy are affected by CVE-2023-22641?
Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, and FortiProxy version 7.0.0 through 7.0.9 are affected by CVE-2023-22641.
What is the description of CVE-2023-22641?
CVE-2023-22641 is a URL redirection vulnerability, also known as an open redirect, in Fortinet FortiOS and FortiProxy. It allows an attacker to redirect users to an untrusted site.
How can I fix CVE-2023-22641?
The vendor recommends upgrading to the latest version of Fortinet FortiOS or FortiProxy to mitigate the vulnerability.