CVE-2023-29178
published 2023-06-13CVE-2023-29178: A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.88%
55.0th percentile
A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | 6.0.0 – 6.0.17 | — |
| fortinet | fortios | 6.2.0 – 6.2.15 | — |
| fortinet | fortios | 6.4.0 – 6.4.13 | — |
| fortinet | fortios | 7.0.0 – 7.0.11 | — |
| fortinet | fortios | 7.2.0 – 7.2.4 | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | 1.1.0 – 1.1.6 | — |
| fortinet | fortiproxy | 1.2.0 – 1.2.13 | — |
| fortinet | fortiproxy | 2.0.0 – 2.0.12 | — |
| fortinet | fortiproxy | 7.0.0 – 7.0.9 | — |
| fortinet | fortiproxy | 7.2.0 – 7.2.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices
cisa_ics·2024-03-14
Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices
ICS Advisory
##
Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices
Release DateMarch 14, 2024
Alert CodeICSA-24-074-11
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM APE1808 devices
- Vulnerabilities: Improper Certificate Validation, Cleartext Transmission of Sensitive Information, Path Traversal, Exposure of Sensitive Information to an Unauthorized
Fortinet
Access of uninitialized pointer in administrative interface API
vendor_fortinet·2023-06-13·CVSS 4.3
CVE-2023-29178 [MEDIUM] CWE-824 Access of uninitialized pointer in administrative interface API
FG-IR-23-095: Access of uninitialized pointer in administrative interface API
A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.
CVEs: CVE-2023-29178
CWEs: CWE-824
CVSS: 4.3 (medium)
Affected products: FortiOS, FortiProxy, Fortinet
GHSA
GHSA-qpph-3p23-86wr: A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7
ghsa_unreviewed·2023-06-13
CVE-2023-29178 [MEDIUM] CWE-824 GHSA-qpph-3p23-86wr: A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7
A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-13
Published