PT-2023-7227 · Fortinet · Fortiproxy+1
Publicado
2023-04-11
·
Atualizado
2023-06-20
·
CVE-2023-22641
CVSS v2.0
5.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
FortiOS versions 6.0 through 7.2.3
FortiOS versions 6.2
FortiOS versions 6.4.0 through 6.4.12
FortiOS versions 7.0.0 through 7.0.9
FortiProxy versions 1.0 through 2.0
FortiProxy versions 1.1
FortiProxy versions 1.2
FortiProxy versions 7.0.0 through 7.0.8
FortiProxy versions 7.2.0 through 7.2.2
Description
The issue is related to a URL redirection to an untrusted site, allowing an authenticated attacker to execute unauthorized code or commands via specially crafted requests. This can enable the attacker to redirect users to any arbitrary website.
Recommendations
For FortiOS versions 6.0 through 7.2.3, update to a version that includes the fix for this issue.
For FortiOS versions 6.2, apply the configuration changes recommended by the vendor to mitigate the risk.
For FortiOS versions 6.4.0 through 6.4.12, restrict access to the sslvpnd module to minimize the risk of exploitation.
For FortiOS versions 7.0.0 through 7.0.9, consider disabling the vulnerable URL redirection feature until a patch is available.
For FortiProxy versions 1.0 through 2.0, avoid using the
sslvpnd module in the affected API endpoint until the issue is resolved.
For FortiProxy versions 1.1 and 1.2, restrict access to the vulnerable module to minimize the risk of exploitation.
For FortiProxy versions 7.0.0 through 7.0.8, update to a version that includes the fix for this issue.
For FortiProxy versions 7.2.0 through 7.2.2, consider disabling the vulnerable URL redirection feature until a patch is available.Correção
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fortios
Fortiproxy