PT-2023-3052 · Fortinet · Fortiweb

Publicado 2023-02-16 · Atualizado 2023-02-24 · CVE-2023-23782

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.1 through 7.0.1 FortiWeb version 6.2 FortiWeb version 6.3.0 through 6.3.19 FortiWeb version 6.4

Description A heap-based buffer overflow in FortiWeb allows an attacker to escalate privileges via specifically crafted arguments to existing commands. The exploitation of this issue may enable an attacker to execute arbitrary code.

Recommendations For FortiWeb versions 6.1 through 7.0.1, update to a version that is not affected by this issue. For FortiWeb version 6.2, consider disabling existing commands that can be exploited with specifically crafted arguments until a patch is available. For FortiWeb version 6.3.0 through 6.3.19, restrict access to commands that can be used for privilege escalation. For FortiWeb version 6.4, avoid using existing commands with specifically crafted arguments until the issue is resolved.

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

BDU:2023-03119

CVE-2023-23782

Produtos afetados

Fortiweb

Referências · 6

• https://fortiguard.com/psirt/FG-IR-22-111 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23782 · Nota de Segurança
• https://vuldb.com/ru/?id.221220 · Nota
• https://t.me/cibsecurity/58346 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23782 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03119 · Nota de Segurança