CVE-2023-36639 - A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests

Back Back to CVE browser

HIGH

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests

Published Dec 13, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.06%

Description

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.

Affected products

Vendor Fortinet Product FortiOS Default
unaffected
Affected
- ≥ 6.0.0, ≤ 6.0.17
- ≥ 6.2.0, ≤ 6.2.15
- ≥ 6.4.0, ≤ 6.4.12
- ≥ 7.0.0, ≤ 7.0.11
- ≥ 7.2.0, ≤ 7.2.4
- 7.4.0
Vendor Fortinet Product FortiPAM Default
unaffected
Affected
- ≥ 1.0.0, ≤ 1.0.3
- 1.1.0
Vendor Fortinet Product FortiProxy Default
unaffected
Affected
- ≥ 7.0.0, ≤ 7.0.10
- ≥ 7.2.0, ≤ 7.2.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Fortinet	FortiOS	unaffected	Affected ≥ 6.0.0, ≤ 6.0.17 ≥ 6.2.0, ≤ 6.2.15 ≥ 6.4.0, ≤ 6.4.12 ≥ 7.0.0, ≤ 7.0.11 ≥ 7.2.0, ≤ 7.2.4 7.4.0
Fortinet	FortiPAM	unaffected	Affected ≥ 1.0.0, ≤ 1.0.3 1.1.0
Fortinet	FortiProxy	unaffected	Affected ≥ 7.0.0, ≤ 7.0.10 ≥ 7.2.0, ≤ 7.2.4

Remediation

Vendor solution

Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.16 or above Please upgrade to FortiPAM version 1.2.0 or above Please upgrade to FortiPAM version 1.1.1 or above Please upgrade to FortiProxy version 7.4.0 or above Please upgrade to FortiProxy version 7.2.5 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiSASE version 23.3 or above

Weaknesses (1)

CWE-134