CVE-2023-23782: Buffer Overflow

Q: What is the vulnerability ID for this heap-based buffer overflow?

The vulnerability ID for this heap-based buffer overflow is CVE-2023-23782.

Q: Which software versions are affected by this vulnerability?

The affected software versions are Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, and FortiWeb 6.2 all versions.

Q: How can an attacker exploit this vulnerability?

An attacker can exploit this vulnerability by providing specifically crafted arguments to existing commands.

Q: What is the severity rating of this vulnerability?

The severity rating of this vulnerability is 7.8 (high).

Q: How can I fix this vulnerability?

To fix this vulnerability, update to a version outside the affected range specified.

Published Feb 16, 2023

Updated

A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands.

Affected Software

4 affected components

Fortinet FortiWeb>=6.0.0<=6.2.7

Fortinet FortiWeb>=6.3.0<6.3.20

Fortinet FortiWeb>=6.4.0<=6.4.2

Fortinet FortiWeb>=7.0.0<7.0.2

Remediation

Information

Upgrade to FortiWeb 7.0.2 or above, upgrade to FortiWeb 6.3.20 or above.

Event History

Feb 16, 2023

CVE Published

via MITRE·06:05 PM

Data Sourced

via MITRE·06:05 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this heap-based buffer overflow?

The vulnerability ID for this heap-based buffer overflow is CVE-2023-23782.

Which software versions are affected by this vulnerability?