CVE-2023-23782 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2023-23782

Modified

More Info Official Page

Source-psirt@fortinet.com

Published At-16 Feb, 2023 | 19:15

Updated At-07 Nov, 2023 | 04:07

A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

>>fortiweb>>Versions from 6.0.0(inclusive) to 6.2.7(inclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

>>fortiweb>>Versions from 6.3.0(inclusive) to 6.3.20(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

>>fortiweb>>Versions from 6.4.0(inclusive) to 6.4.2(inclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

>>fortiweb>>Versions from 7.0.0(inclusive) to 7.0.2(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-122	Secondary	psirt@fortinet.com

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-122

Type: Secondary

Source: psirt@fortinet.com

References

Hyperlink	Source	Resource
https://fortiguard.com/psirt/FG-IR-22-111	psirt@fortinet.com	Vendor Advisory

Hyperlink: https://fortiguard.com/psirt/FG-IR-22-111

Source: psirt@fortinet.com

Resource:

Vendor Advisory