CVE-2023-29178: Access of uninitialized pointer in administrative interface API

Q: What is the vulnerability ID of this Fortinet FortiProxy vulnerability?

The vulnerability ID of this Fortinet FortiProxy vulnerability is CVE-2023-29178.

Q: What is the severity of CVE-2023-29178?

The severity of CVE-2023-29178 is medium with a CVSS score of 4.3.

Q: Which software versions are affected by CVE-2023-29178?

Fortinet FortiProxy versions 7.2.0 through 7.2.3 and versions before 7.0.9, as well as FortiOS versions 7.2.0 through 7.2.4 and versions before 7.0.11 are affected by CVE-2023-29178.

Q: What is the CWE ID of CVE-2023-29178?

The CWE ID of CVE-2023-29178 is CWE-824.

Q: How can an attacker exploit CVE-2023-29178?

An authenticated attacker can repetitively crash the httpsd process of Fortinet FortiProxy and FortiOS by sending crafted HTTP or HTTPS requests.

Published Jun 12, 2023

Updated

A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.

Other sources

An access of uninitialized pointer vulnerability [CWE-824] in FortiOS administrative interface API may allow an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.

— FortiGuard

Affected Software

23 affected componentsFixes available

Fortinet FortiOS>=7.2.0<=7.2.4

Fortinet FortiOS>=7.0.0<=7.0.11

Fortinet FortiOS>=6.4

Fortinet FortiOS>=6.2

Fortinet FortiOS>=6.0

Fortinet FortiProxy>=7.2.0<=7.2.3

Fortinet FortiProxy>=7.0.0<=7.0.9

Fortinet FortiProxy>=2.0

Fortinet FortiProxy>=1.2

Fortinet FortiProxy>=1.1

Fortinet FortiProxy>=1.1.0<=1.1.6

Fortinet FortiProxy>=1.2.0<=1.2.13

Fortinet FortiProxy>=2.0.0<=2.0.12

Fortinet FortiProxy>=7.0.0<=7.0.9

Fortinet FortiProxy=7.2.0

Fortinet FortiProxy=7.2.1

Fortinet FortiProxy=7.2.2

Fortinet FortiProxy=7.2.3

Fortinet FortiOS>=6.0.0<=6.0.17

Fortinet FortiOS>=6.2.0<=6.2.15

Fortinet FortiOS>=6.4.0<=6.4.13

Fortinet FortiOS>=7.0.0<=7.0.11

Fortinet FortiOS>=7.2.0<=7.2.4

Remediation

Information

Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above

Event History

Jun 12, 2023

Advisory Published

via FortiGuard·12:00 AM

Jun 13, 2023

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this Fortinet FortiProxy vulnerability?