Description
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
Published: 2024-05-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiSwitchManager version 7.2.3 or above Please upgrade to FortiSwitchManager version 7.0.3 or above Please upgrade to FortiProxy version 7.2.6 or above Please upgrade to FortiProxy version 7.0.12 or above Please upgrade to FortiPAM version 1.1.1 or above Please upgrade to FortiSASE version 22.4 or above

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-40584 A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
References
History

No history.

Subscriptions

Fortinet Fortios Fortipam Fortiproxy
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2024-08-02T16:52:54.010Z

Reserved: 2023-06-25T18:03:39.227Z

Link: CVE-2023-36640

cve-icon Vulnrichment

Updated: 2024-08-02T16:52:54.010Z

cve-icon NVD

Status : Modified

Published: 2024-05-14T17:15:16.640

Modified: 2024-11-21T08:10:09.313

Link: CVE-2023-36640

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses