CVE-2023-36639: Format String Bug in HTTPSd
A format string vulnerability [CWE-134] in the HTTPSd daemon of FortiOS, FortiProxy and FortiPAM may allow an authenticated user to execute unauthorized code or commands via specially crafted API requests.
Other sources
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36639?
CVE-2023-36639 has a high severity rating due to its potential to allow unauthorized command execution.
How do I fix CVE-2023-36639?
To mitigate CVE-2023-36639, upgrade to FortiOS version 7.4.1, FortiProxy version 7.2.5, or FortiPAM version 1.1.1.
Which software versions are affected by CVE-2023-36639?
CVE-2023-36639 affects FortiOS versions 6.0.0 to 7.0.11, FortiProxy versions 7.0.0 to 7.2.4, and FortiPAM versions 1.0.0 to 1.1.0.
Can unauthenticated users exploit CVE-2023-36639?
No, CVE-2023-36639 is only exploitable by authenticated users who can craft specific API requests.
What are the implications of exploiting CVE-2023-36639?
Exploitation of CVE-2023-36639 could lead to unauthorized code execution or command execution on affected systems.