CVE-2023-36639highCWE-134

CVE-2023-36639

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 1.1%

probabilidade de exploração

1.1%top 39% das CVEs

exploração observada

nãonenhuma fonte reporta

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C

Produtos afetados

Fortinet · FortiOS Fortinet · FortiPAM Fortinet · FortiProxy

Referências

https://fortiguard.com/psirt/FG-IR-23-138