CVE-2023-33305: Medium severity Fortinet FortiProxy vulnerability

Q: What is the vulnerability ID for this Fortinet vulnerability?

The vulnerability ID for this Fortinet vulnerability is CVE-2023-33305.

Q: What is the severity of CVE-2023-33305?

The severity of CVE-2023-33305 is medium with a CVSS score of 6.5.

Q: What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

The CWE ID for this vulnerability is CWE-835.

Q: Where can I find more information about this vulnerability?

You can find more information about this vulnerability at the following link: [FortiGuard Advisory FG-IR-22-375](https://fortiguard.com/psirt/FG-IR-22-375).

Published Jun 13, 2023

Updated

A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.

Affected Software

20 affected components

Fortinet FortiProxy>=1.0.0<=1.0.7

Fortinet FortiProxy>=1.1.0<=1.1.6

Fortinet FortiProxy>=1.2.0<=1.2.13

Fortinet FortiProxy>=2.0.0<=2.0.12

Fortinet FortiProxy>=7.0.0<=7.0.9

Fortinet FortiProxy>=7.2.0<=7.2.3

Fortinet FortiWeb>=6.3.0<=6.3.23

Fortinet FortiWeb>=6.4.0<=6.4.3

Fortinet FortiWeb>=7.0.0<=7.0.6

Fortinet FortiWeb=7.2.0

Fortinet FortiWeb=7.2.1

Fortinet FortiOS>=5.0.0<=5.0.14

Fortinet FortiOS>=5.2.0<=5.2.15

Fortinet FortiOS>=5.4.0<=5.4.13

Fortinet FortiOS>=5.6.0<=5.6.14

Fortinet FortiOS>=6.0.0<=6.0.17

Fortinet FortiOS>=6.2.0<=6.2.15

Fortinet FortiOS>=6.4.0<=6.4.13

Fortinet FortiOS>=7.0.0<=7.0.9

Fortinet FortiOS>=7.2.0<=7.2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.0.11
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.2.5
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.4.0
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.0.10
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.2.4
Upgrade
Upgrade FortiWeb to a version that resolves this vulnerability.
Fixed in 7.0.7
Upgrade
Upgrade FortiWeb to a version that resolves this vulnerability.
Fixed in 7.2.2
Upgrade
Upgrade FortiPAM to a version that resolves this vulnerability.
Fixed in 1.0.0

Event History

Jun 13, 2023

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this Fortinet vulnerability?

The vulnerability ID for this Fortinet vulnerability is CVE-2023-33305.

Which software versions are affected by this vulnerability?

Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0 and more.

What is the severity of CVE-2023-33305?