PT-2023-7383 · Fortinet · Fortiproxy+1

Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-36641

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiProxy versions 1.0 through 7.2.4 FortiProxy version 7.0.0 through 7.0.10 FortiOS version 6.0 through 7.4.0 FortiOS version 7.2.0 through 7.2.5 FortiOS version 7.0.0 through 7.0.12

Description A numeric truncation error in Fortinet FortiProxy and FortiOS allows an attacker to cause a denial of service via specifically crafted HTTP requests. The issue is related to errors in numeric truncation. Exploitation of the issue may allow a remote attacker to cause a denial of service.

Recommendations For FortiProxy versions 1.0 through 7.2.4, update to a version that contains a fix for this issue. For FortiProxy version 7.0.0 through 7.0.10, update to a version that contains a fix for this issue. For FortiOS version 6.0 through 7.4.0, update to a version that contains a fix for this issue. For FortiOS version 7.2.0 through 7.2.5, update to a version that contains a fix for this issue. For FortiOS version 7.0.0 through 7.0.12, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoints until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-197

Related Identifiers

BDU:2023-08415

CVE-2023-36641

Affected Products

Fortios

Fortiproxy

References · 5

• https://fortiguard.com/psirt/FG-IR-23-151 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36641 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08415 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36641 · Security Note
• https://twitter.com/CVEnew/status/1724491741460300242 · Twitter Post