← Back

CVE-2023-45583

nvd nist
Published: May 14, 2024Modified: Oct 22, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.

Affected (12)

Fortinet
4 products
Fortiproxy
Fortiswitchmanager
Fortios
Fortipam
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
version < 7.0.12
Fortiproxy
7.2.0 < version < 7.2.6
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiswitchmanager
7.0.0 ≤ version < 7.0.3
Fortiswitchmanager
7.2.0 ≤ version < 7.2.3
Configuration C
6 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
version < 7.2.6
Fortios
6.2.0 ≤ version ≤ 6.2.16
Fortios
6.4.0 ≤ version ≤ 6.4.15
Fortios
7.0.0 ≤ version ≤ 7.0.12
Fortios
7.2.0 ≤ version ≤ 7.2.5
Fortios
Version 7.4.0
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortipam
1.0.0 ≤ version ≤ 1.0.3
Fortipam
Version 1.1.0

Related CWEs

CWE-134
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (2)

Source: psirt@fortinet.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.