PT-2023-7227 · Fortinet · Fortiproxy+1
Published
2023-04-11
·
Updated
2023-06-20
·
CVE-2023-22641
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
FortiOS versions 6.0 through 7.2.3
FortiOS versions 6.2
FortiOS versions 6.4.0 through 6.4.12
FortiOS versions 7.0.0 through 7.0.9
FortiProxy versions 1.0 through 2.0
FortiProxy versions 1.1
FortiProxy versions 1.2
FortiProxy versions 7.0.0 through 7.0.8
FortiProxy versions 7.2.0 through 7.2.2
Description
The issue is related to a URL redirection to an untrusted site, allowing an authenticated attacker to execute unauthorized code or commands via specially crafted requests. This can enable the attacker to redirect users to any arbitrary website.
Recommendations
For FortiOS versions 6.0 through 7.2.3, update to a version that includes the fix for this issue.
For FortiOS versions 6.2, apply the configuration changes recommended by the vendor to mitigate the risk.
For FortiOS versions 6.4.0 through 6.4.12, restrict access to the sslvpnd module to minimize the risk of exploitation.
For FortiOS versions 7.0.0 through 7.0.9, consider disabling the vulnerable URL redirection feature until a patch is available.
For FortiProxy versions 1.0 through 2.0, avoid using the
sslvpnd module in the affected API endpoint until the issue is resolved.
For FortiProxy versions 1.1 and 1.2, restrict access to the vulnerable module to minimize the risk of exploitation.
For FortiProxy versions 7.0.0 through 7.0.8, update to a version that includes the fix for this issue.
For FortiProxy versions 7.2.0 through 7.2.2, consider disabling the vulnerable URL redirection feature until a patch is available.Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortios
Fortiproxy