CVE-2023-33307: Authenticated user null pointer dereference in SSL-VPN
First published: Fri Jun 16 2023(Updated: )
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<=7.0.9 | |
| Fortinet FortiProxy | >=7.2.0<=7.2.3 | |
| Fortinet FortiOS | >=7.0.0<7.0.11 | |
| Fortinet FortiOS | >=7.2.0<7.2.5 |
Remedy
Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.2.3 or above Please upgrade to FortiProxy version 7.0.9 or above Please upgrade to FortiProxy version 7.0.10 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-33307?
CVE-2023-33307 is a null pointer dereference vulnerability in Fortinet FortiOS and FortiProxy that can be exploited to cause a denial of service in the sslvpn service.
How can an attacker exploit CVE-2023-33307?
An attacker can exploit CVE-2023-33307 by sending a specifically crafted request in the network parameter.
Which versions of Fortinet FortiOS are affected by CVE-2023-33307?
Fortinet FortiOS versions before 7.2.5 and before 7.0.11 are affected by CVE-2023-33307.
Which versions of FortiProxy are affected by CVE-2023-33307?
FortiProxy versions before 7.2.3 and before 7.0.9 are affected by CVE-2023-33307.
What is the severity of CVE-2023-33307?
CVE-2023-33307 has a severity score of 6.5, classified as medium severity.
How can I mitigate the CVE-2023-33307 vulnerability?
To mitigate the CVE-2023-33307 vulnerability, it is recommended to update Fortinet FortiOS to version 7.2.5 or 7.0.11, and FortiProxy to version 7.2.3 or 7.0.9.
Where can I find more information about CVE-2023-33307?
More information about CVE-2023-33307 can be found at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/258201) and [FortiGuard Security Advisory](https://fortiguard.com/psirt/FG-IR-23-015).
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- collector/fortiguard-psirt
- source/FortiGuard
- alias/CVE-2023-33306
- alias/CVE-2023-33307
- agent/references
- agent/title
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.9
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.3
- canonical/fortinet fortios
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.2.0