CVE-2023-33305

Published Jun 13, 2023 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiWeb

unaffected

Version	Status	Constraints
`7.2.0`	affected	≤ 7.2.1
`7.0.0`	affected	≤ 7.0.6
`6.4.0`	affected	≤ 6.4.3
`6.3.0`	affected	≤ 6.3.23

Fortinet

FortiOS

unaffected

Version	Status	Constraints
`7.2.0`	affected	≤ 7.2.4
`7.0.0`	affected	≤ 7.0.10
`6.4.0`	affected	≤ 6.4.13
`6.2.0`	affected	≤ 6.2.15
`6.0.0`	affected	≤ 6.0.17
`5.6.0`	affected	≤ 5.6.14
`5.4.0`	affected	≤ 5.4.13
`5.2.0`	affected	≤ 5.2.15
`5.0.0`	affected	≤ 5.0.14

Fortinet

FortiProxy

unaffected

Version	Status	Constraints
`7.2.0`	affected	≤ 7.2.3
`7.0.0`	affected	≤ 7.0.9
`2.0.0`	affected	≤ 2.0.12
`1.2.0`	affected	≤ 1.2.13
`1.1.0`	affected	≤ 1.1.6
`1.0.0`	affected	≤ 1.0.7

Configuration 1 [-]

OR	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:a:fortinet:fortiweb:7.2.0:::::::*
	cpe:2.3:a:fortinet:fortiweb:7.2.1:::::::*
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::

No data.

No data available yet.

Remediation

Vendor Solution

Please upgrade to FortiPAM version 1.0.0 or above Please upgrade to FortiWeb version 7.2.2 or above Please upgrade to FortiWeb version 7.0.7 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-37468	A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.