CVE-2023-33305
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An infinite loop due to an unreachable exit condition exists in Fortinet FortiOS, FortiProxy, and FortiWeb. Versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, and other listed versions are vulnerable to an attacker performing a denial of service via specially crafted HTTP requests.
Risk Assessment
This vulnerability can be exploited by an attacker to cause service outages, potentially leading to downtime for the organization and loss of availability of critical systems.
Recommendation
It is recommended to upgrade to the latest versions of FortiOS, FortiProxy, and FortiWeb to mitigate this vulnerability and to monitor HTTP traffic for potential attacks.
Original NVD description (English source)
A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.