Paper/Archive/CVE-2023-42784

CVE-2023-42784

Fortinet FortiWeb — An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.1…

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 32.3.323 × 206.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.

Affected

ProductAffectedFixed inSource

FortiWeb7.4.0 – 7.4.7–CNA

FortiWeb7.2.0 – 7.2.10–CNA

FortiWeb7.0.0 – 7.0.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)5.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reffortiguard.fortinet.com/psirt/FG-IR-23-115