CVE-2023-41678: Double free in cache management

Published Dec 12, 2023

Updated

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.

Other sources

A double free vulnerability [CWE-415] in FortiOS and FortiPAM HTTPSd daemon may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted commands.

— FortiGuard

Affected Software

36 affected components

Fortinet FortiOS=7.0.0

Fortinet FortiOS=7.0.1

Fortinet FortiOS=7.0.2

Fortinet FortiOS=7.0.3

Fortinet FortiOS=7.0.4

Fortinet FortiOS=7.0.5

Fortinet FortiPAM=1.0.0

Fortinet FortiPAM=1.0.1

Fortinet FortiPAM=1.0.2

Fortinet FortiPAM=1.0.3

Fortinet FortiPAM=1.1.0

Fortinet FortiPAM=1.1.1

Apple WebKit

Microsoft Power Platform

Microsoft Azure Logic Apps

Microsoft Windows

Adobe Prelude

Adobe Illustrator

Adobe InDesign

Adobe Dimension

Adobe Experience Manager

Adobe Substance3D Stager

Adobe Substance3D Sampler

Adobe Substance3D After Effects

Adobe Substance3D Designer

Google Android

SAP Business Technology Platform (SAP BTP)

Atlassian Bamboo

Atlassian Bitbucket

Atlassian Jira

Atlassian Confluence Data Center

atlassian Confluence Server

cisco Apache Struts

VMware Workspace ONE Launcher

FortiGuard FortiOS

FortiGuard FortiPAM HTTPSd daemon

Remediation

Information

Please upgrade to FortiOS version 7.2.0 or above Please upgrade to FortiOS version 7.0.6 or above Please upgrade to FortiOS version 6.4.15 or above Please upgrade to FortiPAM version 1.2.0 or above Please upgrade to FortiPAM version 1.1.2 or above

Event History

Dec 13, 2023

News Published

12:41 AM

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

RemedyDescriptionSeverityWeakness

Mar 14, 2024

Advisory Published

via FortiGuard·10:01 AM

Data Sourced

via FortiGuard·10:01 AM

DescriptionSeverityWeaknessAffected Software

Oct 25, 2024

Advisory Published

via FortiGuard·11:55 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-41678?

CVE-2023-41678 is rated as critical due to its potential for unauthorized code execution.

How do I fix CVE-2023-41678?

To mitigate CVE-2023-41678, upgrade to a patched version of FortiOS or FortiPAM as recommended by Fortinet.

What systems are affected by CVE-2023-41678?

CVE-2023-41678 affects Fortinet FortiOS versions 7.0.0 through 7.0.5 and FortiPAM versions 1.0.0 through 1.1.1.

What type of vulnerability is CVE-2023-41678?

CVE-2023-41678 is a double free vulnerability, which is classified under CWE-415.

Can CVE-2023-41678 be exploited remotely?

Yes, CVE-2023-41678 can be exploited remotely through specially crafted requests.