A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
Advisories
Source ID Title
EUVD EUVD EUVD-2023-40584 A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
Fixes

Solution

Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiSwitchManager version 7.2.3 or above Please upgrade to FortiSwitchManager version 7.0.3 or above Please upgrade to FortiProxy version 7.2.6 or above Please upgrade to FortiProxy version 7.0.12 or above Please upgrade to FortiPAM version 1.1.1 or above Please upgrade to FortiSASE version 22.4 or above


Workaround

No workaround given by the vendor.

References
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2024-08-02T16:52:54.010Z

Reserved: 2023-06-25T18:03:39.227Z

Link: CVE-2023-36640

cve-icon Vulnrichment

Updated: 2024-08-02T16:52:54.010Z

cve-icon NVD

Status : Modified

Published: 2024-05-14T17:15:16.640

Modified: 2024-11-21T08:10:09.313

Link: CVE-2023-36640

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.