Sign-up

ID

VAR-202302-1559


CVE

CVE-2023-23780


TITLE

fortinet's  Fortiweb  Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-004405

DESCRIPTION

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests. fortinet's Fortiweb Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-23780 // JVNDB: JVNDB-2023-004405 // VULHUB: VHN-452334 // VULMON: CVE-2023-23780

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwebscope:ltversion:7.0.2

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.3.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:ltversion:6.3.20

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:lteversion:6.4.2

Trust: 1.0

vendor:フォーティネットmodel:fortiwebscope:eqversion:7.0.0 that's all 7.0.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.4.0 to 6.4.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope:eqversion:6.3.0 that's all 6.3.20

Trust: 0.8

sources: JVNDB: JVNDB-2023-004405 // NVD: CVE-2023-23780

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-23780
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2023-23780
value: HIGH

Trust: 1.0

NVD: CVE-2023-23780
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202302-1419
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2023-23780
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2023-23780
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-23780
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-004405 // CNNVD: CNNVD-202302-1419 // NVD: CVE-2023-23780 // NVD: CVE-2023-23780

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-121

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-452334 // JVNDB: JVNDB-2023-004405 // NVD: CVE-2023-23780

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202302-1419

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202302-1419

PATCH

title:FG-IR-22-118url:https://fortiguard.com/psirt/FG-IR-22-118

Trust: 0.8

title:Fortinet FortiWeb Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=226799

Trust: 0.6

sources: JVNDB: JVNDB-2023-004405 // CNNVD: CNNVD-202302-1419

EXTERNAL IDS

db:NVDid:CVE-2023-23780

Trust: 3.4

db:JVNDBid:JVNDB-2023-004405

Trust: 0.8

db:CNNVDid:CNNVD-202302-1419

Trust: 0.6

db:VULHUBid:VHN-452334

Trust: 0.1

db:VULMONid:CVE-2023-23780

Trust: 0.1

sources: VULHUB: VHN-452334 // VULMON: CVE-2023-23780 // JVNDB: JVNDB-2023-004405 // CNNVD: CNNVD-202302-1419 // NVD: CVE-2023-23780

REFERENCES

url:https://fortiguard.com/psirt/fg-ir-22-118

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-23780

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-23780/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-452334 // VULMON: CVE-2023-23780 // JVNDB: JVNDB-2023-004405 // CNNVD: CNNVD-202302-1419 // NVD: CVE-2023-23780

SOURCES

db:VULHUBid:VHN-452334
db:VULMONid:CVE-2023-23780
db:JVNDBid:JVNDB-2023-004405
db:CNNVDid:CNNVD-202302-1419
db:NVDid:CVE-2023-23780

LAST UPDATE DATE

2024-08-14T14:24:16.186000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-452334date:2023-02-28T00:00:00
db:VULMONid:CVE-2023-23780date:2023-02-16T00:00:00
db:JVNDBid:JVNDB-2023-004405date:2023-10-30T05:43:00
db:CNNVDid:CNNVD-202302-1419date:2023-03-01T00:00:00
db:NVDid:CVE-2023-23780date:2023-11-07T04:07:57.703

SOURCES RELEASE DATE

db:VULHUBid:VHN-452334date:2023-02-16T00:00:00
db:VULMONid:CVE-2023-23780date:2023-02-16T00:00:00
db:JVNDBid:JVNDB-2023-004405date:2023-10-30T00:00:00
db:CNNVDid:CNNVD-202302-1419date:2023-02-16T00:00:00
db:NVDid:CVE-2023-23780date:2023-02-16T19:15:14.250