Most severe vulnerabilities for "fortinet fortiproxy ssl vpn webmode" 7.0.10

Where

AND

Sort:

Fortinet FortiProxyFormat String Bug in HTTPSd

Risk 79

Severity

8.8

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C

A format string vulnerability [CWE-134] in the HTTPSd daemon of FortiOS, FortiProxy and FortiPAM may allow an authenticated user to execute unauthorized code or commands via specially crafted API requests.

1 / 2

Source: FortiGuard

Remedy

Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.16 or above Please upgrade to FortiPAM version 1.2.0 or above Please upgrade to FortiPAM version 1.1.1 or above Please upgrade to FortiProxy version 7.4.0 or above Please upgrade to FortiProxy version 7.2.5 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiSASE version 23.3 or above

First published (updated )

CVE-2023-36639

Fortinet FortiOSStored XSS in guest management page

Risk 70

Severity

7.3

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS and FortiProxy GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.

First published (updated )

Advisory

FG-IR-23-106

Fortinet FortiOSFormat String Bug in HTTPSd

Risk 66

Severity

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C

First published (updated )

Advisory

FG-IR-23-138

Fortinet FortiProxySMTP password ciphertext exposure in Log

Risk 39

Severity

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS / FortiProxy log events may allow a remote authenticated attacker to read certain passwords in ciphertext.

1 / 2

Source: FortiGuard

Remedy

Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiProxy version 7.2.2 or above

First published (updated )

CVE-2023-26207

Fortinet FortiProxyDOS in headers management

Risk 38

Severity

6.5

Null Pointer Dereference

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C

A null pointer dereference [CWE-476] in FortiOS and FortiProxy SSL VPN may allow an authenticated attacker to perform a DoS attack on the device via specifically crafted HTTP requests.

1 / 2

Source: FortiGuard

Remedy

Please upgrade to FortiSASE version 23.3.b or above Please upgrade to FortiProxy version 7.2.5 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiOS version 7.0.13 or above

First published (updated )

CVE-2023-36641

Fortinet FortiOSDOS in headers management

Risk 37

Severity

6.2

Null Pointer Dereference

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C

A null pointer dereference [CWE-476] in FortiOS and FortiProxy SSL VPN may allow an authenticated attacker to perform a DoS attack on the device via specifically crafted HTTP requests.

First published (updated )

Advisory

FG-IR-23-151

Trending

Fortinet FortiProxyFormat String Bug in HTTPSd

Remedy

Fortinet FortiOSStored XSS in guest management page

Fortinet FortiOSFormat String Bug in HTTPSd

Fortinet FortiProxySMTP password ciphertext exposure in Log

Remedy

Fortinet FortiProxyDOS in headers management

Remedy

Fortinet FortiOSDOS in headers management

Company

Resources

Contact