Sign-up

ID

VAR-202302-1380


CVE

CVE-2023-25602


TITLE

fortinet's  Fortiweb  Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-004325

DESCRIPTION

A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments. fortinet's Fortiweb Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-25602 // JVNDB: JVNDB-2023-004325 // VULHUB: VHN-454626 // VULMON: CVE-2023-25602

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwebscope:ltversion:6.0.8

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.3.18

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.0.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:lteversion:6.4.2

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:5.6.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.3.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.1.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:5.9.2

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.2.7

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.1.3

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.2.0

Trust: 1.0

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.0.0 that's all 6.0.8

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.4.0 to 6.4.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.3.0 that's all 6.3.18

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:5.6.0 that's all 5.9.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.2.0 that's all 6.2.7

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.1.0 that's all 6.1.3

Trust: 0.8

sources: JVNDB: JVNDB-2023-004325 // NVD: CVE-2023-25602

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-25602
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2023-25602
value: HIGH

Trust: 1.0

NVD: CVE-2023-25602
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202302-1416
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2023-25602
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-25602
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-004325 // CNNVD: CNNVD-202302-1416 // NVD: CVE-2023-25602 // NVD: CVE-2023-25602

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-121

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-454626 // JVNDB: JVNDB-2023-004325 // NVD: CVE-2023-25602

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202302-1416

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202302-1416

PATCH

title:FG-IR-21-234url:https://www.fortiguard.com/psirt/FG-IR-21-234

Trust: 0.8

title:Fortinet FortiWeb Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=226967

Trust: 0.6

sources: JVNDB: JVNDB-2023-004325 // CNNVD: CNNVD-202302-1416

EXTERNAL IDS

db:NVDid:CVE-2023-25602

Trust: 3.4

db:JVNDBid:JVNDB-2023-004325

Trust: 0.8

db:AUSCERTid:ESB-2023.1158

Trust: 0.6

db:CNNVDid:CNNVD-202302-1416

Trust: 0.6

db:VULHUBid:VHN-454626

Trust: 0.1

db:VULMONid:CVE-2023-25602

Trust: 0.1

sources: VULHUB: VHN-454626 // VULMON: CVE-2023-25602 // JVNDB: JVNDB-2023-004325 // CNNVD: CNNVD-202302-1416 // NVD: CVE-2023-25602

REFERENCES

url:https://fortiguard.com/psirt/fg-ir-21-234

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-25602

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-25602/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.1158

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-454626 // VULMON: CVE-2023-25602 // JVNDB: JVNDB-2023-004325 // CNNVD: CNNVD-202302-1416 // NVD: CVE-2023-25602

SOURCES

db:VULHUBid:VHN-454626
db:VULMONid:CVE-2023-25602
db:JVNDBid:JVNDB-2023-004325
db:CNNVDid:CNNVD-202302-1416
db:NVDid:CVE-2023-25602

LAST UPDATE DATE

2024-08-14T15:32:14.491000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-454626date:2023-02-27T00:00:00
db:VULMONid:CVE-2023-25602date:2023-02-16T00:00:00
db:JVNDBid:JVNDB-2023-004325date:2023-10-30T01:02:00
db:CNNVDid:CNNVD-202302-1416date:2023-02-28T00:00:00
db:NVDid:CVE-2023-25602date:2023-11-07T04:09:02.980

SOURCES RELEASE DATE

db:VULHUBid:VHN-454626date:2023-02-16T00:00:00
db:VULMONid:CVE-2023-25602date:2023-02-16T00:00:00
db:JVNDBid:JVNDB-2023-004325date:2023-10-30T00:00:00
db:CNNVDid:CNNVD-202302-1416date:2023-02-16T00:00:00
db:NVDid:CVE-2023-25602date:2023-02-16T19:15:14.583