CVE-2023-27997

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-23-097	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::

Configuration 2 (hide)

AND

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios:6.0.10:::::::*
	cpe:2.3:o:fortinet:fortios:6.2.4:::::::*
	cpe:2.3:o:fortinet:fortios:6.2.6:::::::*
	cpe:2.3:o:fortinet:fortios:6.2.7:::::::*
	cpe:2.3:o:fortinet:fortios:6.4.2:::::::*
	cpe:2.3:o:fortinet:fortios:6.4.6:::::::*
	cpe:2.3:o:fortinet:fortios:6.4.8:::::::*
	cpe:2.3:o:fortinet:fortios:6.4.10:::::::*
	cpe:2.3:o:fortinet:fortios:6.4.12:::::::*
	cpe:2.3:o:fortinet:fortios:7.0.5:::::::*
	cpe:2.3:o:fortinet:fortios:7.0.10:::::::*

OR	cpe:2.3:h:fortinet:fortigate_6000:-:::::::*
	cpe:2.3:h:fortinet:fortigate_7000:-:::::::*

History

No history.

Information

Published : 2023-06-13 09:15

Updated : 2024-06-27 19:12

NVD link : CVE-2023-27997

Mitre link : CVE-2023-27997

CVE.ORG link : CVE-2023-27997

JSON object : View

Products Affected

fortinet

fortiproxy
fortigate_6000
fortigate_7000
fortios

CWE

CWE-787

Out-of-bounds Write

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2023-27997", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-06-13T09:15:16.613", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-097", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."}], "lastModified": "2024-06-27T19:12:51.177", "cisaActionDue": "2023-07-04", "cisaExploitAdd": "2023-06-13", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B", "versionEndIncluding": "1.1.6", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05", "versionEndIncluding": "1.2.13", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C1D5E6B-A23E-4A92-B53C-720AFEB1B951", "versionEndIncluding": "2.0.12", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAC18F7E-5242-4F36-BB42-FEC33B3AC075", "versionEndIncluding": "7.0.9", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A99FF48-370E-4D2A-B5CC-889EA21AB213", "versionEndIncluding": "7.2.3", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EA5512D-6EE5-4DF3-A960-C02394F25225", "versionEndIncluding": "6.0.16", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CD57A5A-2B13-495A-8530-8F97E1720602", "versionEndIncluding": "6.2.13", "versionStartIncluding": "6.2.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E99B6E5-7EC3-406C-AFAC-A5E32DE266DF", "versionEndIncluding": "6.4.12", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2573C90-BE6A-4D5D-A223-F09213318909", "versionEndIncluding": "7.0.11", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AB643A8-B52F-4D54-B816-28A6401BAA25", "versionEndIncluding": "7.2.4", "versionStartIncluding": "7.2.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D997493-24C2-4A78-9DF0-6438E9415A3C", "versionEndIncluding": "6.0.16", "versionStartIncluding": "6.0.12"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A0D0D55-1A51-454D-A8B1-D7100D453102", "versionEndIncluding": "6.2.13", "versionStartIncluding": "6.2.9"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6AF1FA-A034-439A-876B-BFA1BE7DE15E"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9694FC0C-408A-4892-ADD1-F36F4BBBD9EF"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B8A132F-601F-4129-BFCA-3A976A711D5A"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90600B14-07C4-455D-9FC1-17034D91B987"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B28478DA-8D10-4A8E-81EA-D3DF421E5089"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2F935F9-5B6A-47C2-8F65-7A1E8BB061FF"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "751D2FC7-482F-4C6B-95DB-244004A2738E"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEE44B20-6F00-4962-9929-5A5054BBA94C"}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB2FF1DA-001B-4CA1-9F46-427D9C92CBC6"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48D0E8CC-3815-4697-86D0-DC7F66E70520"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78C6C937-4477-438D-A252-E4102D758120"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3BB410C9-CDD4-4068-97E0-6D83AE62B7F1"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E0CBA773-10C1-410D-BB01-771F454ABEBA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@fortinet.com", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability"}