CVE-2023-27997
En bref Sévérité CRITICAL 9.2 Exploitation Exploitation connue (CISA KEV) · ajoutée le 2023-06-13 Exploitée selon l'ENISA depuis le 2023-06-13 EPSS EPSS 85.69 % · centile 100 (2026-10-27) État PUBLISHED Publiée 2023-06-13 Mise à jour 2026-07-31 Attribuée par fortinet Statut NVD Analyzed Description A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R fortinet CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.1.0 ≤ 1.1.6cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.2.0 ≤ 1.2.13cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.12cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.9cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.3cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.4cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.12 ≤ 6.0.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.9 ≤ 6.2.13cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*Produits affectés Produit Versions Fortinet · FortiOS-6K7K affected 7.0.10 ; affected 7.0.5 ; affected 6.4.12 ; affected 6.4.10 ; affected 6.4.8 ; affected 6.4.6 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.3 ; affected 7.0.0 ≤ 7.0.9 ; affected 2.0.0 ≤ 2.0.12 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.11 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.13 ; affected 6.0.0 ≤ 6.0.16
Références
Sources
