CVE-2023-33307: Authenticated user null pointer dereference in SSL-VPN
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
Other sources
A NULL pointer dereference vulnerability [CWE-476] in SSL-VPN may allow an authenticated remote attacker to trigger a crash of the SSL-VPN service via crafted requests.
— FortiGuard
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 6.4.13 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.0.11 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.4.0 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.10 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.3 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
What is CVE-2023-33307?
CVE-2023-33307 is a null pointer dereference vulnerability in Fortinet FortiOS and FortiProxy that can be exploited to cause a denial of service in the sslvpn service.
How can an attacker exploit CVE-2023-33307?
An attacker can exploit CVE-2023-33307 by sending a specifically crafted request in the network parameter.
Which versions of Fortinet FortiOS are affected by CVE-2023-33307?
Fortinet FortiOS versions before 7.2.5 and before 7.0.11 are affected by CVE-2023-33307.
Which versions of FortiProxy are affected by CVE-2023-33307?
FortiProxy versions before 7.2.3 and before 7.0.9 are affected by CVE-2023-33307.
What is the severity of CVE-2023-33307?
CVE-2023-33307 has a severity score of 6.5, classified as medium severity.
How can I mitigate the CVE-2023-33307 vulnerability?
To mitigate the CVE-2023-33307 vulnerability, it is recommended to update Fortinet FortiOS to version 7.2.5 or 7.0.11, and FortiProxy to version 7.2.3 or 7.0.9.
Where can I find more information about CVE-2023-33307?
More information about CVE-2023-33307 can be found at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/258201) and [FortiGuard Security Advisory](https://fortiguard.com/psirt/FG-IR-23-015).