FG-IR-23-138: Format String Bug in HTTPSd
Published Dec 12, 2023
·Updated
A format string vulnerability [CWE-134] in the HTTPSd daemon of FortiOS, FortiProxy and FortiPAM may allow an authenticated user to execute unauthorized code or commands via specially crafted API requests.
Affected Software
10 affected componentsFixes available
Fortinet FortiOS=.
Fortinet FortiOS>=7.2.0<=7.2.4
Fortinet FortiOS>=7.0.0<=7.0.11
Fortinet FortiOS>=6.4.0<=6.4.12
Fortinet FortiOS>=6.2.0<=6.2.15
Fortinet FortiOS>=6.0
Fortinet FortiPAM=.
Fortinet FortiPAM>=1.0
Fortinet FortiProxy>=7.2.0<=7.2.4
Fortinet FortiProxy>=7.0.0<=7.0.10
Event History
Dec 12, 2023
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-23-138?
The severity of FG-IR-23-138 is high due to the potential for unauthorized code execution.
2
How do I fix FG-IR-23-138?
To fix FG-IR-23-138, upgrade FortiOS, FortiProxy, or FortiPAM to the specified remedial versions based on your current version.
3
Which products are affected by FG-IR-23-138?
FG-IR-23-138 affects FortiOS, FortiProxy, and FortiPAM across several versions.
4
What type of vulnerability is FG-IR-23-138?
FG-IR-23-138 is a format string vulnerability classified under CWE-134.
5
Who is the vendor for FG-IR-23-138?
The vendor for FG-IR-23-138 is Fortinet.