PT-2023-3765 · Fortinet · Fortiproxy+1

Published 2023-06-12 · Updated 2023-06-17 · CVE-2022-43953

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.2 and earlier FortiOS versions 6.4 and earlier FortiOS versions 7.0 and earlier FortiOS versions 7.2.0 through 7.2.4 FortiProxy versions 7.0.0 through 7.0.7 FortiProxy versions 7.2.0 through 7.2.1

Description The issue is related to a use of externally-controlled format string in the command line interpreter of FortiOS and FortiProxy, which may allow an attacker to execute unauthorized code or commands via specially crafted commands or arguments. This could potentially be exploited by an authenticated user.

Recommendations For FortiOS versions 6.2 and earlier, update to a version that is not affected by this issue. For FortiOS versions 6.4 and earlier, update to a version that is not affected by this issue. For FortiOS versions 7.0 and earlier, update to a version that is not affected by this issue. For FortiOS versions 7.2.0 through 7.2.4, update to a version that is not affected by this issue. For FortiProxy versions 7.0.0 through 7.0.7, update to a version that is not affected by this issue. For FortiProxy versions 7.2.0 through 7.2.1, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the command line interpreter until a patch is available.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2023-04054

CVE-2022-43953

Affected Products

Fortios

Fortiproxy

References · 5

• https://osv.dev/vulnerability/CVE-2022-43953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04054 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43953 · Security Note
• https://vuldb.com/?id.231311 · Note