CVE-2024-23113

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

CVSS v3.0 9.8 CRITICAL

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-24-029	Vendor Advisory
https://fortiguard.com/psirt/FG-IR-24-029	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:fortinet:fortipam::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:o:fortinet:fortipam::::::::
	cpe:2.3:o:fortinet:fortipam:1.2.0:::::::*
	cpe:2.3:a:fortinet:fortiswitchmanager::::::::
	cpe:2.3:a:fortinet:fortiswitchmanager::::::::
	cpe:2.3:o:fortinet:fortios::::::::

History

29 Nov 2024, 15:09

Type	Values Removed	Values Added
CWE	~~CWE-134~~

22 Feb 2024, 15:33

Type	Values Removed	Values Added
CPE		cpe:2.3:o:fortinet:fortipam:::::::: cpe:2.3:o:fortinet:fortios:::::::: cpe:2.3:a:fortinet:fortiswitchmanager:::::::: cpe:2.3:a:fortinet:fortiproxy:::::::: cpe:2.3:o:fortinet:fortipam:1.2.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Fortinet Fortinet fortios Fortinet fortiproxy Fortinet fortipam Fortinet fortiswitchmanager
References	~~() https://fortiguard.com/psirt/FG-IR-24-029 -~~	() https://fortiguard.com/psirt/FG-IR-24-029 - Vendor Advisory

15 Feb 2024, 14:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-15 14:15

Updated : 2024-11-29 15:09

NVD link : CVE-2024-23113

Mitre link : CVE-2024-23113

JSON object : View

Products Affected

fortinet

fortiproxy
fortiswitchmanager
fortipam
fortios

CWE

No CWE.

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://fortiguard.com/psirt/FG-IR-24-029", "name": "https://fortiguard.com/psirt/FG-IR-24-029", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://fortiguard.com/psirt/FG-IR-24-029", "name": "https://fortiguard.com/psirt/FG-IR-24-029", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-23113", "ASSIGNER": "psirt@fortinet.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2024-02-15T14:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.3", "versionStartIncluding": "1.0.0"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.0.13", "versionStartIncluding": "7.0.0"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.2.6", "versionStartIncluding": "7.2.0"}, {"cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.4.2", "versionStartIncluding": "7.4.0"}, {"cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.2.8", "versionStartIncluding": "7.2.0"}, {"cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.0.14", "versionStartIncluding": "7.0.0"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.1.2", "versionStartIncluding": "1.1.0"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.0.3", "versionStartIncluding": "7.0.0"}, {"cpe23Uri": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.2.3", "versionStartIncluding": "7.2.0"}, {"cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.4.2", "versionStartIncluding": "7.4.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-11-29T15:09Z"}