CVE-2023-46714

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46714", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-10-25T08:43:15.289Z", "datePublished": "2024-05-14T16:19:13.614Z", "dateUpdated": "2024-08-02T20:53:20.924Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiOS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.1", "status": "affected"}, {"versionType": "semver", "version": "7.2.1", "lessThanOrEqual": "7.2.6", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-05-14T16:19:13.614Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiOS version 7.4.2 or above \nPlease upgrade to FortiOS version 7.2.8 or above \nPlease upgrade to FortiAuthenticator version 6.6.1 or above \nPlease upgrade to FortiAuthenticator version 6.5.5 or above \n"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-23-415", "url": "https://fortiguard.com/psirt/FG-IR-23-415"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-14T18:38:21.376226Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortios", "versions": [{"status": "affected", "version": "7.2.1", "versionType": "custom", "lessThanOrEqual": "7.2.6"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortios", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "custom", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:22:20.601Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:53:20.924Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-23-415", "url": "https://fortiguard.com/psirt/FG-IR-23-415", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-415", "name": "https://fortiguard.com/psirt/FG-IR-23-415", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:53:20.924Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-14T18:38:21.376226Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortios", "versions": [{"status": "affected", "version": "7.2.1", "versionType": "custom", "lessThanOrEqual": "7.2.6"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortios", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "custom", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-14T18:39:59.370Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Fortinet", "product": "FortiOS", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.1"}, {"status": "affected", "version": "7.2.1", "versionType": "semver", "lessThanOrEqual": "7.2.6"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiOS version 7.4.2 or above \nPlease upgrade to FortiOS version 7.2.8 or above \nPlease upgrade to FortiAuthenticator version 6.6.1 or above \nPlease upgrade to FortiAuthenticator version 6.5.5 or above \n"}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-415", "name": "https://fortiguard.com/psirt/FG-IR-23-415"}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-05-14T16:19:13.614Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46714", "state": "PUBLISHED", "dateUpdated": "2024-08-02T20:53:20.924Z", "dateReserved": "2023-10-25T08:43:15.289Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2024-05-14T16:19:13.614Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FortiOS", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.6", "status": "affected", "version": "7.2.1", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}, {"affectedData": [{"cpes": ["cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "fortios", "vendor": "fortinet", "versions": [{"lessThanOrEqual": "7.2.6", "status": "affected", "version": "7.2.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "fortios", "vendor": "fortinet", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D1811FC-A5FC-4828-ACB1-0D2568FA9240", "versionEndIncluding": "7.2.6", "versionStartIncluding": "7.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "61540F5B-080A-4D44-8BE0-75D7A0DCCB53", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "17FE168A-0EA4-467C-91D2-87EB6D83917A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria [CWE-121] en Fortinet FortiOS versi\u00f3n 7.2.1 a 7.2.6 y versi\u00f3n 7.4.0 a 7.4.1 permite a un atacante privilegiado sobre la interfaz administrativa ejecutar c\u00f3digo o comandos arbitrarios a trav\u00e9s de HTTP o Solicitudes HTTP."}], "id": "CVE-2023-46714", "lastModified": "2026-06-17T06:31:24.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-46714", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-14T18:38:21.376226Z", "version": "2.0.3"}}]}, "published": "2024-05-14T17:15:25.840", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-23-415"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-23-415"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{}