Paper/Archive/CVE-2020-29016

CVE-2020-29016

Fortinet Fortinet FortiWeb — A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote…

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 89.0.890 × 2017.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname.

Affected

ProductAffectedFixed inSource

Fortinet FortiWebFortiWeb 6.3.0 through 6.3.5 and version before 6.2.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-20-125