CVE-2023-22640CWE-787

CVE-2023-22640

High · published May 4, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.13, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2023-05-04T02:15Z
Affected products (9)
ProductVersionsFixed in
fortinet/fortiproxyall versions—
fortinet/fortiproxyall versions—
fortinet/fortiproxyall versions—
fortinet/fortiproxyall versions—
fortinet/fortios≥ 6.0.0, ≤ 6.0.16—
fortinet/fortios≥ 6.2.0, < 6.2.146.2.14
fortinet/fortios≥ 6.4.0, < 6.4.126.4.12
fortinet/fortios≥ 7.0.0, < 7.0.117.0.11
fortinet/fortios≥ 7.2.0, < 7.2.47.2.4
References (2)
https://fortiguard.com/psirt/FG-IR-22-475 · [email protected]https://fortiguard.com/psirt/FG-IR-22-475 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 MAY 21:26Z
    A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS…
    cvelistv5