Lucene search

[email protected]NVD:CVE-2023-41675

HistoryOct 10, 2023 - 5:15 p.m.

CVE-2023-41675

2023-10-1017:15:12

CWE-416

[email protected]

web.nvd.nist.gov

vulnerability

fortios

fortiproxy

use-after-free

version 7.0.x

version 7.2.x

remote attacker

wad process

crafted packets

proxy mode

ssl inspection

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

37.5%

JSON

A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.

Affected configurations

Nvd

Node

fortinetfortiproxyRange7.0.0–7.0.8

fortinetfortiproxyMatch7.2.0

fortinetfortiproxyMatch7.2.1

fortinetfortiproxyMatch7.2.2

fortinetfortiosRange7.0.0–7.0.10

fortinetfortiosRange7.2.0–7.2.4

VendorProductVersionCPE
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy7.2.0cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
fortinetfortiproxy7.2.1cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
fortinetfortiproxy7.2.2cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	7.2.0	cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::*
fortinet	fortiproxy	7.2.1	cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::*
fortinet	fortiproxy	7.2.2	cpe:2.3:a:fortinet:fortiproxy:7.2.2:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::