CVE-2023-23777

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters...

CVE-2023-23777

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters...

CVE-2023-23777

CVE-2023-23777 is an OS Command Injection in FortiWeb. Root cause: improper neutralization of special elements in OS commands, exploitable via crafted CLI backup parameters. Affected: FortiWeb 7.0.1 and earlier, 6.4 all versions, 6.3.18 and earlier. Impact: privileged attacker could execute arbit...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...

The vulnerability of FortiWeb web applications’ network firewalls, FortiOS operating systems, and FortiProxy proxy servers relates to the execution of a loop with an unavailable exit condition. This allows attackers to cause service interruptions.

The vulnerability of FortiWeb web applications’ firewalls, FortiOS operating systems, and FortiProxy proxy servers for protecting against Internet attacks is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow a remote attacker to cause...

CVE-2023-33305

A loop with unreachable exit condition 'infinite loop' in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0....

Design/Logic Flaw

A loop with unreachable exit condition 'infinite loop' in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0....

Fortinet Fortigate DoS in firmware upgrade function (FG-IR-22-375)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-375 advisory. - A loop with unreachable exit condition 'infinite loop' in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0...

PT-2023-3237 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0 through 7.2.4 FortiProxy versions 1.0 through 7.2.3 FortiWeb versions 6.3 through 7.2.1 Description: The issue is related to a loop with an unreachable exit condition, also known as an 'infinite loop', which can be...

Fortinet FortiWeb DoS in firmware upgrade function (FG-IR-22-375)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-375 advisory. - A loop with unreachable exit condition 'infinite loop' in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0....

Protect

A loop with unreachable exit condition 'Infinite Loop' vulnerability CWE-835 in FortiOS, FortiProxy and Fortiweb may allow an authenticated attacker to perform a denial of service via a specially crafted firmware image...

The vulnerability of FortiWeb web applications’ network firewalls, related to the use of an uncontrolled format string, allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to the use of an uncontrolled format string. Exploiting this vulnerability could allow a hacker to execute arbitrary code...

The vulnerability of FortiWeb web applications’ network firewalls, related to writing beyond the buffer in memory, allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially crafted command arguments...

The vulnerability of FortiWeb web applications’ network firewalls, related to the re-release of memory, allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to the re-release of memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of FortiWeb web applications’ network firewalls, related to overflowing heap-based buffers, allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to buffer overflow attacks. Exploiting this vulnerability can allow attackers to execute arbitrary code...

Fortinet FortiWeb OS command injection in CLI (FG-IR-22-186)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-186 advisory. - A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0....

Fortinet FortiWeb xss (FG-IR-22-428)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-428 advisory. - An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3...

Vulnerabilities fixed in Fortinet FortiWeb and FortiADC

Fortinet has fixed vulnerabilities in FortiWeb and FortiADC. A malicious party can exploit the vulnerability with reference CVE-2022-43955 exploit to perform a cross-site scripting attack XSS on the web interface of the vulnerable systems. Such an attack can lead to execution of code within the...

CVE-2022-43948

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions,...

CVE-2022-43955

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...