CVE-2023-33308: Proxy mode with deep inspection - Stack-based buffer overflow
First published: Tue Jul 11 2023(Updated: )
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
Credit: psirt@fortinet.com psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<=7.0.9 | |
| Fortinet FortiProxy | =7.2.0 | |
| Fortinet FortiProxy | =7.2.1 | |
| Fortinet FortiProxy | =7.2.2 | |
| Fortinet FortiOS | >=7.0.0<=7.0.10 | |
| Fortinet FortiOS | >=7.2.0<=7.2.3 |
Remedy
Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.4 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiProxy version 7.2.3 or above Please upgrade to FortiProxy version 7.0.10 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Fortinet FortiOS vulnerability?
The vulnerability ID of this Fortinet FortiOS vulnerability is CVE-2023-33308.
What is the severity level of CVE-2023-33308?
CVE-2023-33308 has a severity level of 9.8, which is considered critical.
Which software versions are affected by CVE-2023-33308?
Fortinet FortiOS versions 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3, as well as FortiProxy versions 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2, are affected by CVE-2023-33308.
What is the CWE ID of CVE-2023-33308?
CVE-2023-33308 has a CWE ID of 787.
How can this vulnerability be exploited?
An unauthenticated attacker can execute arbitrary code or command by sending crafted packets to the affected Fortinet devices.
- agent/author
- agent/type
- agent/softwarecombine
- collector/nvd-latest
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- collector/fortiguard-psirt
- source/FortiGuard
- alias/CVE-2023-33308
- agent/severity
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/tags
- collector/fortiguard-psirt-latest
- agent/event
- agent/trending
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.1
- canonical/fortinet fortios
- version/fortinet fortios/7.2.0
- version/fortinet fortios/7.2.3
- version/fortinet fortiproxy/7.2.2
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.9
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.10