CVE-2023-36639
At a glance Severity HIGH 7.0 EPSS EPSS 1.06 % · percentile 64 (2026-10-27) State PUBLISHED Published 2023-12-13 Updated 2024-08-02 Assigner fortinet NVD status Modified Description A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.0 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C fortinet CVSS 3.1 HIGH 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.10cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.4cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.17cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.4cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:* ≥ 1.0.0 ≤ 1.0.3cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*Affected products Product Versions Fortinet · FortiOS affected 7.4.0 ; affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.11 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.15 ; affected 6.0.0 ≤ 6.0.17 Fortinet · FortiPAM affected 1.1.0 ; affected 1.0.0 ≤ 1.0.3 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.10
References
Sources
