CVE-2023-33307
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
Risk Assessment
This vulnerability may lead to a denial of service for the sslvpn, impacting the organization's operations and access to resources.
Recommendation
It is recommended to update FortiOS and FortiProxy to the latest versions to mitigate this vulnerability.
Other vulnerabilities in Fortinet FortiOS, FortiProxy
See all- CVE-2018-13382CriticalActively exploited
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests.
- CVE-2018-13379CriticalActively exploited
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
- CVE-2023-41677High
A insufficiently protected credentials vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via a targeted social engineering attack.
- CVE-2023-29180High
A null pointer dereference vulnerability in Fortinet FortiOS and FortiProxy across multiple versions allows an attacker to cause a denial of service via specially crafted HTTP requests.
- CVE-2023-36641Medium
A numeric truncation error vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to cause a denial of service via specifically crafted HTTP requests.
- CVE-2023-29178Medium
An access of uninitialized pointer vulnerability (CWE-824) in Fortinet FortiOS and FortiProxy allows an authenticated attacker to repeatedly crash the httpsd process via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS