CVE-2023-36639

CWE-134 — Uncontrolled Format String4 documents4 sources
Severity
8.8HIGH
EPSS
0.2%
top 60.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Fortinet FortiosFortinet FortipamFortinet Fortiproxy
Timeline
PublishedDec 13

Description

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5fortinet/fortios7.2.0 — 7.2.4+5
▶NVDfortinet/fortios6.0.0 — 6.0.17+5
▶CVEListV5fortinet/fortipam1.0.0 — 1.0.3+1
▶NVDfortinet/fortipam1.0.0 — 1.0.3+1
▶CVEListV5fortinet/fortiproxy7.2.0 — 7.2.4+1

🔴Vulnerability Details

2
CVEList
CVE-2023-36639: A use of externally-controlled format string in Fortinet FortiProxy versions 7↗2023-12-13
▶
GHSA
GHSA-rhfj-295m-9hhj: A use of externally-controlled format string in Fortinet FortiProxy versions 7↗2023-12-13
▶

📋Vendor Advisories

1
Fortinet
Format String Bug in HTTPSd↗2023-12-13
▶
CVE-2023-36639 (HIGH CVSS 8.8) | A use of externally-controlled form | cvebase.io