CVE-2023-29175: Lack of certificate verification when establishing secure connections
First published: Mon Jun 12 2023(Updated: )
An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=1.2.0<=1.2.13 | |
| Fortinet FortiProxy | >=2.0.0<=2.0.12 | |
| Fortinet FortiProxy | >=7.0.0<=7.0.9 | |
| Fortinet FortiProxy | >=7.2.0<=7.2.3 | |
| Fortinet FortiOS | >=6.0.0<=6.0.17 | |
| Fortinet FortiOS | >=6.2.0<=6.2.15 | |
| Fortinet FortiOS | >=6.4.0<=6.4.13 | |
| Fortinet FortiOS | >=7.0.0<7.0.11 | |
| Fortinet FortiOS | =7.2.0 |
Remedy
Please upgrade to FortiOS version 7.2.1 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this FortiOS vulnerability?
The vulnerability ID for this FortiOS vulnerability is CVE-2023-29175.
What is the severity of CVE-2023-29175?
The severity of CVE-2023-29175 is medium with a CVSS score of 4.8.
Which versions of FortiOS are affected by CVE-2023-29175?
FortiOS versions 6.2, 6.4, 7.0.0 - 7.0.10, and 7.2.0 are affected by CVE-2023-29175.
Which versions of FortiProxy are affected by CVE-2023-29175?
FortiProxy versions 1.2.0 - 1.2.13, 2.0.0 - 2.0.12, 7.0.0 - 7.0.9, and 7.2.0 - 7.2.3 are affected by CVE-2023-29175.
How can I fix CVE-2023-29175?
To fix CVE-2023-29175, update to the latest available version of FortiOS or FortiProxy.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- collector/fortiguard-psirt
- source/FortiGuard
- alias/CVE-2023-29175
- agent/references
- agent/title
- agent/severity
- agent/description
- agent/first-publish-date
- agent/tags
- collector/fortiguard-psirt-latest
- agent/event
- agent/trending
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/1.2.0
- version/fortinet fortiproxy/1.2.13
- version/fortinet fortiproxy/2.0.0
- version/fortinet fortiproxy/2.0.12
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.9
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.3
- canonical/fortinet fortios
- version/fortinet fortios/6.0.0
- version/fortinet fortios/6.0.17
- version/fortinet fortios/6.2.0
- version/fortinet fortios/6.2.15
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.13
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.2.0