Vulnerability-Lookup

CVE-2023-27997 (GCVE-0-2023-27997)

Vulnerability from cvelistv5 – Published: 2023-06-13 08:41 – Updated: 2026-07-31 03:55

CISA ENISA Previdian

Summary

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Severity

9.2 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2023-06-12 00:00 UTC

CWE

CWE-122 - Execute unauthorized code or commands

Assigner

fortinet CNA under the mitre root

CNA scorecard C 72/100 over 145 records in the last 180 days details

References

2 references

URL	Tags
https://fortiguard.com/psirt/FG-IR-23-097
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

3 products

Vendor	Product	Version	CPE status
Fortinet	FortiOS-6K7K	Affected: 7.0.10 Affected: 7.0.5 Affected: 6.4.12 Affected: 6.4.10 Affected: 6.4.8 Affected: 6.4.6 Affected: 6.4.2 Affected: 6.2.9 , ≤ 6.2.13 (semver) Affected: 6.2.6 , ≤ 6.2.7 (semver) Affected: 6.2.4 Affected: 6.0.12 , ≤ 6.0.16 (semver) Affected: 6.0.10	guessed
Fortinet	FortiProxy	Affected: 7.2.0 , ≤ 7.2.3 (semver) Affected: 7.0.0 , ≤ 7.0.9 (semver) Affected: 2.0.0 , ≤ 2.0.12 (semver) Affected: 1.2.0 , ≤ 1.2.13 (semver) Affected: 1.1.0 , ≤ 1.1.6 (semver)	guessed
Fortinet	FortiOS	Affected: 7.2.0 , ≤ 7.2.4 (semver) Affected: 7.0.0 , ≤ 7.0.11 (semver) Affected: 6.4.0 , ≤ 6.4.12 (semver) Affected: 6.2.0 , ≤ 6.2.13 (semver) Affected: 6.0.0 , ≤ 6.0.16 (semver)	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 346deb33-3493-4fb2-8ad7-b283e06e5fb1

Vulnerability ID: CVE-2023-27997

Status: Confirmed

Status Updated: 2023-06-13 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-13

Asserted: 2023-06-13

Scope

Notes: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | Affected: Fortinet / FortiOS and FortiProxy SSL-VPN | Description: Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-04 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-23-097; https://nvd.nist.gov/vuln/detail/CVE-2023-27997

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-122
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	FortiOS and FortiProxy SSL-VPN
Due Date	2023-07-04
Date Added	2023-06-13
Vendorproject	Fortinet
Vulnerabilityname	Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2023-27997

Created: 2026-02-02 12:26 UTC | Updated: 2026-11-04 13:36 UTC

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: f61b42b7-e6ee-412f-9e02-0aae72d1e58f

Vulnerability ID: CVE-2023-27997

Status: Confirmed

Status Updated: 2025-01-23 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-01-23

Asserted: 2025-01-23

Scope

Notes: Affected: Fortinet / FortiOS and FortiProxy | Description: Heap-based buffer overflow vulnerability may allow remote attackers to execute arbitrary code or commands | Patched since: 2023/06/09 | Exploitation type: ransomware | Origin source: CNW

Evidence

Type: Csirt Report

Signal: Confirmed Compromise

Confidence: 75%

Source: enisa-cnw-kev

Details

Cwes
Euvd	EUVD-2023-31722
Notes
Catalog	ENISA / EU CSIRTs Network (CNW) KEV JSON
Product	FortiOS and FortiProxy
Datereported	2025/01/23
Originsource	CNW
Patchedsince	2023/06/09
Vendorproject	Fortinet
Exploitationtype	ransomware
Vulnerabilityname
Threatactorsexploiting

References

Created: 2026-02-02 12:25 UTC | Updated: 2026-11-04 13:28 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 84fc248a-9b72-46f2-b671-7b4d6f52f056

Vulnerability ID: CVE-2023-27997

Status: Confirmed

Status Updated: 2023-06-13 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-13

Asserted: 2023-06-13

Scope

Notes: KEVIntel entry: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,... | Affected: Fortinet / FortiOS-6K7K, FortiProxy, FortiOS | CVSS: 9.2 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,...
Vendor	Fortinet
Product	FortiOS-6K7K, FortiProxy, FortiOS
Added Date	2023-06-13T00:00:00.000Z
Cvss Score	9.2
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	yes
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 14:05 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:23:30.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://fortiguard.com/psirt/FG-IR-23-097",
            "tags": [
              "x_transferred"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-23-097"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27997",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-06-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-06-13",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T03:55:27.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-06-13T00:00:00.000Z",
            "value": "CVE-2023-27997 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FortiOS-6K7K",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.10"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "6.4.12"
            },
            {
              "status": "affected",
              "version": "6.4.10"
            },
            {
              "status": "affected",
              "version": "6.4.8"
            },
            {
              "status": "affected",
              "version": "6.4.6"
            },
            {
              "status": "affected",
              "version": "6.4.2"
            },
            {
              "lessThanOrEqual": "6.2.13",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2.4"
            },
            {
              "lessThanOrEqual": "6.0.16",
              "status": "affected",
              "version": "6.0.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.10"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.9",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.13",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.1.6",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.4",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.11",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.12",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.13",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.16",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-13T08:41:47.415Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.com/psirt/FG-IR-23-097",
          "url": "https://fortiguard.com/psirt/FG-IR-23-097"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiOS-6K7K version 7.0.12 or above\r\nPlease upgrade to FortiOS-6K7K version 6.4.13 or above\r\nPlease upgrade to FortiOS-6K7K version 6.2.15 or above\r\nPlease upgrade to FortiOS-6K7K version 6.0.17 or above\r\nPlease upgrade to FortiProxy version 7.2.4 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above\r\nPlease upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.5 or above\r\nPlease upgrade to FortiOS version 7.0.12 or above\r\nPlease upgrade to FortiOS version 6.4.13 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiOS version 6.0.17 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2023-27997",
    "datePublished": "2023-06-13T08:41:47.415Z",
    "dateReserved": "2023-03-09T10:09:33.119Z",
    "dateUpdated": "2026-07-31T03:55:27.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-27997",
      "cwes": [
        "CWE-122"
      ],
      "dateAdded": "2023-06-13",
      "dueDate": "2023-07-04",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://www.fortiguard.com/psirt/FG-IR-23-097;  https://nvd.nist.gov/vuln/detail/CVE-2023-27997",
      "product": "FortiOS and FortiProxy SSL-VPN",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.",
      "vendorProject": "Fortinet",
      "vulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability"
    },
    "cnw_known_exploited": {
      "CVE": "CVE-2023-27997",
      "EUVD": "EUVD-2023-31722",
      "cwes": "-",
      "dateReported": "23/01/25",
      "exploitationType": "ransomware",
      "notes": "-",
      "originSource": "cnw",
      "product": "FortiOS and FortiProxy",
      "shortDescription": "-",
      "threatActorsExploiting": "-",
      "vendorProject": "Fortinet",
      "vulnerabilityName": "-"
    },
    "epss": {
      "cve": "CVE-2023-27997",
      "date": "2026-11-13",
      "epss": "0.8675",
      "percentile": "0.99747"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-07-04",
      "cisaExploitAdd": "2023-06-13",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability",
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
                  "versionEndIncluding": "1.1.6",
                  "versionStartIncluding": "1.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
                  "versionEndIncluding": "1.2.13",
                  "versionStartIncluding": "1.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7C1D5E6B-A23E-4A92-B53C-720AFEB1B951",
                  "versionEndIncluding": "2.0.12",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DAC18F7E-5242-4F36-BB42-FEC33B3AC075",
                  "versionEndIncluding": "7.0.9",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3A99FF48-370E-4D2A-B5CC-889EA21AB213",
                  "versionEndIncluding": "7.2.3",
                  "versionStartIncluding": "7.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8EA5512D-6EE5-4DF3-A960-C02394F25225",
                  "versionEndIncluding": "6.0.16",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3CD57A5A-2B13-495A-8530-8F97E1720602",
                  "versionEndIncluding": "6.2.13",
                  "versionStartIncluding": "6.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5E99B6E5-7EC3-406C-AFAC-A5E32DE266DF",
                  "versionEndIncluding": "6.4.12",
                  "versionStartIncluding": "6.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C2573C90-BE6A-4D5D-A223-F09213318909",
                  "versionEndIncluding": "7.0.11",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4AB643A8-B52F-4D54-B816-28A6401BAA25",
                  "versionEndIncluding": "7.2.4",
                  "versionStartIncluding": "7.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6D997493-24C2-4A78-9DF0-6438E9415A3C",
                  "versionEndIncluding": "6.0.16",
                  "versionStartIncluding": "6.0.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0A0D0D55-1A51-454D-A8B1-D7100D453102",
                  "versionEndIncluding": "6.2.13",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FA6AF1FA-A034-439A-876B-BFA1BE7DE15E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9694FC0C-408A-4892-ADD1-F36F4BBBD9EF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2B8A132F-601F-4129-BFCA-3A976A711D5A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "90600B14-07C4-455D-9FC1-17034D91B987",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B28478DA-8D10-4A8E-81EA-D3DF421E5089",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C2F935F9-5B6A-47C2-8F65-7A1E8BB061FF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "751D2FC7-482F-4C6B-95DB-244004A2738E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EEE44B20-6F00-4962-9929-5A5054BBA94C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EB2FF1DA-001B-4CA1-9F46-427D9C92CBC6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "48D0E8CC-3815-4697-86D0-DC7F66E70520",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "78C6C937-4477-438D-A252-E4102D758120",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3BB410C9-CDD4-4068-97E0-6D83AE62B7F1",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E0CBA773-10C1-410D-BB01-771F454ABEBA",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
        }
      ],
      "id": "CVE-2023-27997",
      "lastModified": "2024-11-21T07:53:53.957",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-06-13T09:15:16.613",
      "references": [
        {
          "source": "psirt@fortinet.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://fortiguard.com/psirt/FG-IR-23-097"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://fortiguard.com/psirt/FG-IR-23-097"
        }
      ],
      "sourceIdentifier": "psirt@fortinet.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-122"
            }
          ],
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-787"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "FortiOS-6K7K",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0.10"
                  },
                  {
                    "status": "affected",
                    "version": "7.0.5"
                  },
                  {
                    "status": "affected",
                    "version": "6.4.12"
                  },
                  {
                    "status": "affected",
                    "version": "6.4.10"
                  },
                  {
                    "status": "affected",
                    "version": "6.4.8"
                  },
                  {
                    "status": "affected",
                    "version": "6.4.6"
                  },
                  {
                    "status": "affected",
                    "version": "6.4.2"
                  },
                  {
                    "lessThanOrEqual": "6.2.13",
                    "status": "affected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.7",
                    "status": "affected",
                    "version": "6.2.6",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "6.2.4"
                  },
                  {
                    "lessThanOrEqual": "6.0.16",
                    "status": "affected",
                    "version": "6.0.12",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "6.0.10"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "FortiProxy",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.2.3",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.9",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "2.0.12",
                    "status": "affected",
                    "version": "2.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "1.2.13",
                    "status": "affected",
                    "version": "1.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "1.1.6",
                    "status": "affected",
                    "version": "1.1.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "FortiOS",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.2.4",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.11",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.12",
                    "status": "affected",
                    "version": "6.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.13",
                    "status": "affected",
                    "version": "6.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.16",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          }
        ],
        "cisaActionDue": "2023-07-04",
        "cisaExploitAdd": "2023-06-13",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
                    "versionEndIncluding": "1.1.6",
                    "versionStartIncluding": "1.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
                    "versionEndIncluding": "1.2.13",
                    "versionStartIncluding": "1.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7C1D5E6B-A23E-4A92-B53C-720AFEB1B951",
                    "versionEndIncluding": "2.0.12",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DAC18F7E-5242-4F36-BB42-FEC33B3AC075",
                    "versionEndIncluding": "7.0.9",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3A99FF48-370E-4D2A-B5CC-889EA21AB213",
                    "versionEndIncluding": "7.2.3",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8EA5512D-6EE5-4DF3-A960-C02394F25225",
                    "versionEndIncluding": "6.0.16",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3CD57A5A-2B13-495A-8530-8F97E1720602",
                    "versionEndIncluding": "6.2.13",
                    "versionStartIncluding": "6.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E99B6E5-7EC3-406C-AFAC-A5E32DE266DF",
                    "versionEndIncluding": "6.4.12",
                    "versionStartIncluding": "6.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2573C90-BE6A-4D5D-A223-F09213318909",
                    "versionEndIncluding": "7.0.11",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4AB643A8-B52F-4D54-B816-28A6401BAA25",
                    "versionEndIncluding": "7.2.4",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D997493-24C2-4A78-9DF0-6438E9415A3C",
                    "versionEndIncluding": "6.0.16",
                    "versionStartIncluding": "6.0.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0A0D0D55-1A51-454D-A8B1-D7100D453102",
                    "versionEndIncluding": "6.2.13",
                    "versionStartIncluding": "6.2.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6AF1FA-A034-439A-876B-BFA1BE7DE15E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9694FC0C-408A-4892-ADD1-F36F4BBBD9EF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B8A132F-601F-4129-BFCA-3A976A711D5A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "90600B14-07C4-455D-9FC1-17034D91B987",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B28478DA-8D10-4A8E-81EA-D3DF421E5089",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2F935F9-5B6A-47C2-8F65-7A1E8BB061FF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "751D2FC7-482F-4C6B-95DB-244004A2738E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EEE44B20-6F00-4962-9929-5A5054BBA94C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB2FF1DA-001B-4CA1-9F46-427D9C92CBC6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "48D0E8CC-3815-4697-86D0-DC7F66E70520",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78C6C937-4477-438D-A252-E4102D758120",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3BB410C9-CDD4-4068-97E0-6D83AE62B7F1",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E0CBA773-10C1-410D-BB01-771F454ABEBA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
          }
        ],
        "id": "CVE-2023-27997",
        "lastModified": "2026-07-31T04:16:43.707",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-27997",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-06-12T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-06-13T09:15:16.613",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-23-097"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-23-097"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T11:42:33+00:00",
      "cve": "CVE-2023-27997",
      "id": "CVE-2023-27997",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2023-27997",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-27997.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T12:23:30.864Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://fortiguard.com/psirt/FG-IR-23-097",
                "tags": [
                  "x_transferred"
                ],
                "url": "https://fortiguard.com/psirt/FG-IR-23-097"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-27997",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-23T13:18:08.089433Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2023-06-13",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-23T13:00:31.878Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2023-06-13T00:00:00.000Z",
                "value": "CVE-2023-27997 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "FortiOS-6K7K",
              "vendor": "Fortinet",
              "versions": [
                {
                  "status": "affected",
                  "version": "7.0.10"
                },
                {
                  "status": "affected",
                  "version": "7.0.5"
                },
                {
                  "status": "affected",
                  "version": "6.4.12"
                },
                {
                  "status": "affected",
                  "version": "6.4.10"
                },
                {
                  "status": "affected",
                  "version": "6.4.8"
                },
                {
                  "status": "affected",
                  "version": "6.4.6"
                },
                {
                  "status": "affected",
                  "version": "6.4.2"
                },
                {
                  "lessThanOrEqual": "6.2.13",
                  "status": "affected",
                  "version": "6.2.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.7",
                  "status": "affected",
                  "version": "6.2.6",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "6.2.4"
                },
                {
                  "lessThanOrEqual": "6.0.16",
                  "status": "affected",
                  "version": "6.0.12",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "6.0.10"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "FortiProxy",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.2.3",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.9",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "2.0.12",
                  "status": "affected",
                  "version": "2.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "1.2.13",
                  "status": "affected",
                  "version": "1.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "1.1.6",
                  "status": "affected",
                  "version": "1.1.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "FortiOS",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.2.4",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.11",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.4.12",
                  "status": "affected",
                  "version": "6.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.13",
                  "status": "affected",
                  "version": "6.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.16",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "Execute unauthorized code or commands",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-06-13T08:41:47.415Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.com/psirt/FG-IR-23-097",
              "url": "https://fortiguard.com/psirt/FG-IR-23-097"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Please upgrade to FortiOS-6K7K version 7.0.12 or above\r\nPlease upgrade to FortiOS-6K7K version 6.4.13 or above\r\nPlease upgrade to FortiOS-6K7K version 6.2.15 or above\r\nPlease upgrade to FortiOS-6K7K version 6.0.17 or above\r\nPlease upgrade to FortiProxy version 7.2.4 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above\r\nPlease upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.5 or above\r\nPlease upgrade to FortiOS version 7.0.12 or above\r\nPlease upgrade to FortiOS version 6.4.13 or above\r\nPlease upgrade to FortiOS version 6.2.14 or above\r\nPlease upgrade to FortiOS version 6.0.17 or above"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2023-27997",
        "datePublished": "2023-06-13T08:41:47.415Z",
        "dateReserved": "2023-03-09T10:09:33.119Z",
        "dateUpdated": "2026-07-31T03:55:27.798Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2023-ALE-004

Vulnerability from certfr_alerte - Published: - Updated:

Le 12 juin 2023, Fortinet a publié un avis de sécurité concernant la vulnérabilité CVE-2023-27997. Celle-ci permet à un attaquant non authentifié d'exécuter du code arbitraire à distance sur des produits Fortinet qui proposent une fonctionnalité de VPN SSL.

Dans une communication supplémentaire (cf. section Documentation), Fortinet indique que cette vulnérabilité n'est exploitable que si la fonctionnalité VPN SSL est activée. De plus, celle-ci serait activement exploitée dans le cadre d'attaques ciblées.

Le CERT-FR a connaissance d'une preuve de concept disponible publiquement. En l'état, le code permet uniquement un déni de service à distance. Le CERT-FR recommande donc d'appliquer le correctif, disponible depuis le 9 juin 2023, dans les meilleurs délais.

La communication supplémentaire [1] de Fortinet contient également des recommandations utiles concernant la recherche de marqueurs de compromission, le durcissement de l'équipement ainsi que le rappel de bonnes pratiques de sécurité.

Solution

L'application seule des correctifs n'est pas suffisante. Il est fortement recommandé :

d'effectuer une analyse des systèmes, en cas de suspicion de compromission, il est recommandé de continuer les investigations afin de déterminer les actions prises par un éventuel attaquant [2];
d'appliquer les mesures de durcissement fournies par l'éditeur et de respecter les bonnes pratiques de sécurité.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.0.10
Fortinet	FortiOS	FortiOS versions 6.0.x antérieures à 6.0.17
Fortinet	FortiOS	FortiOS versions 6.2.x antérieures à 6.2.14
Fortinet	FortiOS	FortiOS-6K7K versions 6.0.x antérieures à 6.0.17
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.5
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.15
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.13
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.4
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.12
Fortinet	FortiOS	FortiOS versions 6.4.x antérieures à 6.4.13
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.12

References

Title

Publication Time

Tags

Bulletin de sécurité FG-IR-23-097 du 12 juin 2023	None	vendor-advisory
[2] Les bons réflexes en cas d’intrusion sur un système d’information	-	other
Avis CERT-FR CERTFR-2023-AVI-0451 du 13 juin 2023	-	other
[1] Communication de Fortinet sur la vulnérabilité CVE-2023-27997 du 12 juin 2023	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.14",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.5",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.15",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2023-09-11",
  "content": "## Solution\n\nL\u0027application seule des correctifs n\u0027est pas suffisante. Il est\nfortement recommand\u00e9 :\n\n-   d\u0027effectuer une analyse des syst\u00e8mes, en cas de suspicion de\n    compromission, il est recommand\u00e9 de continuer les investigations\n    afin de d\u00e9terminer les actions prises par un \u00e9ventuel attaquant\n    \\[2\\];\n-   d\u0027appliquer les mesures de durcissement fournies par l\u0027\u00e9diteur et de\n    respecter les bonnes pratiques de s\u00e9curit\u00e9.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    }
  ],
  "links": [
    {
      "title": "[2] Les bons r\u00e9flexes en cas d\u2019intrusion sur un syst\u00e8me d\u2019information",
      "url": "https://www.cert.ssi.gouv.fr/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2023-AVI-0451 du 13 juin 2023",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2023-AVI-0451/"
    },
    {
      "title": "[1] Communication de Fortinet sur la vuln\u00e9rabilit\u00e9 CVE-2023-27997 du 12 juin 2023",
      "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign"
    }
  ],
  "reference": "CERTFR-2023-ALE-004",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-13T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2023-09-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 12 juin 2023, Fortinet a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la\nvuln\u00e9rabilit\u00e9 CVE-2023-27997. Celle-ci permet \u00e0 un attaquant non\nauthentifi\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance sur des produits\nFortinet qui proposent une fonctionnalit\u00e9 de *VPN SSL*.\n\nDans une communication suppl\u00e9mentaire (cf. section Documentation),\nFortinet indique que cette vuln\u00e9rabilit\u00e9 n\u0027est exploitable que si la\nfonctionnalit\u00e9 *VPN SSL* est activ\u00e9e. De plus, celle-ci serait\nactivement exploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es.\n\nLe CERT-FR a connaissance d\u0027une preuve de concept disponible\npubliquement. En l\u0027\u00e9tat, le code permet uniquement un d\u00e9ni de service \u00e0\ndistance. Le CERT-FR recommande donc d\u0027appliquer le correctif,\ndisponible depuis le 9 juin 2023, dans les meilleurs d\u00e9lais.\n\nLa communication suppl\u00e9mentaire \\[1\\] de Fortinet contient \u00e9galement des\nrecommandations utiles concernant la recherche de marqueurs de\ncompromission, le durcissement de l\u0027\u00e9quipement ainsi que le rappel de\nbonnes pratiques de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-097 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-097"
    }
  ]
}

CERTFR-2023-ALE-004

Vulnerability from certfr_alerte - Published: - Updated:

Solution

L'application seule des correctifs n'est pas suffisante. Il est fortement recommandé :

d'effectuer une analyse des systèmes, en cas de suspicion de compromission, il est recommandé de continuer les investigations afin de déterminer les actions prises par un éventuel attaquant [2];
d'appliquer les mesures de durcissement fournies par l'éditeur et de respecter les bonnes pratiques de sécurité.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.0.10
Fortinet	FortiOS	FortiOS versions 6.0.x antérieures à 6.0.17
Fortinet	FortiOS	FortiOS versions 6.2.x antérieures à 6.2.14
Fortinet	FortiOS	FortiOS-6K7K versions 6.0.x antérieures à 6.0.17
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.5
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.15
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.13
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.4
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.12
Fortinet	FortiOS	FortiOS versions 6.4.x antérieures à 6.4.13
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.12

References

Title

Publication Time

Tags

Bulletin de sécurité FG-IR-23-097 du 12 juin 2023	None	vendor-advisory
[2] Les bons réflexes en cas d’intrusion sur un système d’information	-	other
Avis CERT-FR CERTFR-2023-AVI-0451 du 13 juin 2023	-	other
[1] Communication de Fortinet sur la vulnérabilité CVE-2023-27997 du 12 juin 2023	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.14",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.5",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.15",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2023-09-11",
  "content": "## Solution\n\nL\u0027application seule des correctifs n\u0027est pas suffisante. Il est\nfortement recommand\u00e9 :\n\n-   d\u0027effectuer une analyse des syst\u00e8mes, en cas de suspicion de\n    compromission, il est recommand\u00e9 de continuer les investigations\n    afin de d\u00e9terminer les actions prises par un \u00e9ventuel attaquant\n    \\[2\\];\n-   d\u0027appliquer les mesures de durcissement fournies par l\u0027\u00e9diteur et de\n    respecter les bonnes pratiques de s\u00e9curit\u00e9.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    }
  ],
  "links": [
    {
      "title": "[2] Les bons r\u00e9flexes en cas d\u2019intrusion sur un syst\u00e8me d\u2019information",
      "url": "https://www.cert.ssi.gouv.fr/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/"
    },
    {
      "title": "Avis CERT-FR CERTFR-2023-AVI-0451 du 13 juin 2023",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2023-AVI-0451/"
    },
    {
      "title": "[1] Communication de Fortinet sur la vuln\u00e9rabilit\u00e9 CVE-2023-27997 du 12 juin 2023",
      "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign"
    }
  ],
  "reference": "CERTFR-2023-ALE-004",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-13T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2023-09-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 12 juin 2023, Fortinet a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la\nvuln\u00e9rabilit\u00e9 CVE-2023-27997. Celle-ci permet \u00e0 un attaquant non\nauthentifi\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance sur des produits\nFortinet qui proposent une fonctionnalit\u00e9 de *VPN SSL*.\n\nDans une communication suppl\u00e9mentaire (cf. section Documentation),\nFortinet indique que cette vuln\u00e9rabilit\u00e9 n\u0027est exploitable que si la\nfonctionnalit\u00e9 *VPN SSL* est activ\u00e9e. De plus, celle-ci serait\nactivement exploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es.\n\nLe CERT-FR a connaissance d\u0027une preuve de concept disponible\npubliquement. En l\u0027\u00e9tat, le code permet uniquement un d\u00e9ni de service \u00e0\ndistance. Le CERT-FR recommande donc d\u0027appliquer le correctif,\ndisponible depuis le 9 juin 2023, dans les meilleurs d\u00e9lais.\n\nLa communication suppl\u00e9mentaire \\[1\\] de Fortinet contient \u00e9galement des\nrecommandations utiles concernant la recherche de marqueurs de\ncompromission, le durcissement de l\u0027\u00e9quipement ainsi que le rappel de\nbonnes pratiques de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-097 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-097"
    }
  ]
}

CERTFR-2023-AVI-0451

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.0.10
Fortinet	FortiSIEM	FortiSIEM versions antérieures à 7.0.0
Fortinet	FortiWeb	FortiWeb versions 7.2.x antérieures à 7.2.2
Fortinet	N/A	FortiConverter versions 6.x antérieures à 6.2.2
Fortinet	FortiManager	FortiManager versions 7.2.x antérieures à 7.2.2
Fortinet	FortiNAC	FortiNAC versions 8.x à 9.1.x antérieures à 9.1.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.4.x antérieures à 6.4.12
Fortinet	N/A	FortiADCManager versions 5.x à 7.0.x antérieures à 7.0.1
Fortinet	FortiNAC	FortiNAC versions 9.2.x antérieures à 9.2.8
Fortinet	FortiNAC	FortiNAC versions 9.4.x antérieures à 9.4.3
Fortinet	FortiOS	FortiOS versions 6.x à 7.0.x antérieures à 7.0.12
Fortinet	FortiManager	FortiManager versions 6.4.x antérieures à 6.4.12
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.2.x antérieures à 7.2.2
Fortinet	N/A	FortiClientWindows versions 6.4.x antérieures à 6.4.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.2
Fortinet	FortiManager	FortiManager versions 7.0.x antérieures à 7.0.7
Fortinet	N/A	FortiConverter versions 7.0.x antérieures à 7.0.1
Fortinet	FortiOS	FortiOS-6K7K versions 6.0.x antérieures à 6.0.17
Fortinet	FortiNAC	FortiNAC-F versions 7.2.x antérieures à 7.2.1
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.5
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.15
Fortinet	FortiWeb	FortiWeb versions 6.x à 7.0.x antérieures à 7.0.7
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.0.x antérieures à 7.0.2
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.13
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.4
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.12
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.7
Fortinet	FortiADC	FortiADC versions 5.x à 7.1.x antérieures à 7.1.3
Fortinet	N/A	FortiClientWindows versions 7.0.x antérieures à 7.0.7
Fortinet	FortiADC	FortiADC versions 7.2.x antérieures à 7.2.1
Fortinet	N/A	FortiADCManager versions antérieures à 7.1.1
Fortinet	FortiPAM	FortiPAM versions antérieures à 1.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité FG-IR-22-380 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-076 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-494 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-21-141 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-111 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-521 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-229 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-125 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-097 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-107 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-259 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-468 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-258 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-095 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-463 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-119 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-393 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-375 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-455 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-493 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-332 du 12 juin 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSIEM versions ant\u00e9rieures \u00e0 7.0.0",
      "product": {
        "name": "FortiSIEM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiConverter versions 6.x ant\u00e9rieures \u00e0 6.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 8.x \u00e0 9.1.x ant\u00e9rieures \u00e0 9.1.9",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADCManager versions 5.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.8",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.3",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitchManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiSwitchManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions 6.4.x ant\u00e9rieures \u00e0 6.4.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiConverter versions 7.0.x ant\u00e9rieures \u00e0 7.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC-F versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.5",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.15",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitchManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
      "product": {
        "name": "FortiSwitchManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADC versions 5.x \u00e0 7.1.x ant\u00e9rieures \u00e0 7.1.3",
      "product": {
        "name": "FortiADC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADC versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiADC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADCManager versions ant\u00e9rieures \u00e0 7.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPAM versions ant\u00e9rieures \u00e0 1.0.0",
      "product": {
        "name": "FortiPAM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-25609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25609"
    },
    {
      "name": "CVE-2023-22633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22633"
    },
    {
      "name": "CVE-2022-39946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39946"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2022-42478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42478"
    },
    {
      "name": "CVE-2022-33877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33877"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-26210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26210"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2022-43949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43949"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2023-26204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26204"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-28000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28000"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0451",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-380 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-380"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-076 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-076"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-494 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-494"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-21-141 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-21-141"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-111 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-111"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-521 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-521"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-229 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-229"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-125 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-125"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-097 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-097"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-107 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-107"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-259 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-259"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-468 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-468"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-258 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-258"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-095 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-095"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-463 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-463"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-119 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-119"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-393 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-393"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-375 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-375"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-455 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-455"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-493 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-493"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-332 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-332"
    }
  ]
}

CERTFR-2024-AVI-0203

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	Cerberus PRO EN Engineering Tool versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8
Siemens	N/A	RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions
Siemens	N/A	Sinteso FS20 EN Engineering Tool versions antérieures à MP8
Siemens	N/A	SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.2
Siemens	N/A	Solid Edge versions antérieures à V223.0.11
Siemens	N/A	Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	SINEMA Remote Connect Client versions antérieures à V3.1 SP1
Siemens	N/A	SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Sinteso Mobile versions antérieures à V3.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité Siemens SSA-792319 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-918992 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-353002 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-653855 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-225840 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-145196 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-382651 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-832273 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-366067 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-770721 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-576771 du 12 mars 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cerberus PRO EN Engineering Tool versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Fire Panel FC20 versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM APE1808 avec Fortinet NGFW versions ant\u00e9rieures \u00e0 V7.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Engineering Tool versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF160B (6GT2003-0FA00) versions ant\u00e9rieures \u00e0 V2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Solid Edge versions ant\u00e9rieures \u00e0 V223.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Control versions sup\u00e9rieures ou \u00e9gales \u00e0 V2.8 versions ant\u00e9rieures \u00e0 V3.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN Fire Panel FC72x versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Client versions ant\u00e9rieures \u00e0 V3.1 SP1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso Mobile versions ant\u00e9rieures \u00e0 V3.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
    },
    {
      "name": "CVE-2017-18509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
    },
    {
      "name": "CVE-2021-0599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
    },
    {
      "name": "CVE-2021-0443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
    },
    {
      "name": "CVE-2022-20462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
    },
    {
      "name": "CVE-2021-0598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
    },
    {
      "name": "CVE-2021-0438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
    },
    {
      "name": "CVE-2021-0651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
    },
    {
      "name": "CVE-2021-0585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
    },
    {
      "name": "CVE-2021-0331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
    },
    {
      "name": "CVE-2021-0509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
    },
    {
      "name": "CVE-2021-0601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
    },
    {
      "name": "CVE-2021-0478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
    },
    {
      "name": "CVE-2021-0397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
    },
    {
      "name": "CVE-2021-0600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
    },
    {
      "name": "CVE-2021-0928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
    },
    {
      "name": "CVE-2021-0484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
    },
    {
      "name": "CVE-2023-36641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36641"
    },
    {
      "name": "CVE-2021-0642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
    },
    {
      "name": "CVE-2021-0341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2021-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
    },
    {
      "name": "CVE-2020-24587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
    },
    {
      "name": "CVE-2017-14491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
    },
    {
      "name": "CVE-2022-20421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
    },
    {
      "name": "CVE-2021-0593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
    },
    {
      "name": "CVE-2022-20498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
    },
    {
      "name": "CVE-2021-0473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2021-0870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
    },
    {
      "name": "CVE-2020-0417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
    },
    {
      "name": "CVE-2020-29660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
    },
    {
      "name": "CVE-2021-0604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
    },
    {
      "name": "CVE-2021-0522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
    },
    {
      "name": "CVE-2021-39629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
    },
    {
      "name": "CVE-2020-29661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
    },
    {
      "name": "CVE-2021-38204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
    },
    {
      "name": "CVE-2022-20229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
    },
    {
      "name": "CVE-2023-33306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33306"
    },
    {
      "name": "CVE-2022-39948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
    },
    {
      "name": "CVE-2022-20423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
    },
    {
      "name": "CVE-2021-0396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
    },
    {
      "name": "CVE-2021-0650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
    },
    {
      "name": "CVE-2021-0329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
    },
    {
      "name": "CVE-2023-41675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41675"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-29183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29183"
    },
    {
      "name": "CVE-2021-0471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2021-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
    },
    {
      "name": "CVE-2021-0327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
    },
    {
      "name": "CVE-2021-0653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
    },
    {
      "name": "CVE-2021-0690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
    },
    {
      "name": "CVE-2021-39634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
    },
    {
      "name": "CVE-2021-0596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
    },
    {
      "name": "CVE-2023-47537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
    },
    {
      "name": "CVE-2023-28002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28002"
    },
    {
      "name": "CVE-2023-22641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
    },
    {
      "name": "CVE-2021-0919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
    },
    {
      "name": "CVE-2021-0968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
    },
    {
      "name": "CVE-2022-20500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
    },
    {
      "name": "CVE-2021-29647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
    },
    {
      "name": "CVE-2021-0521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
    },
    {
      "name": "CVE-2020-11301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
    },
    {
      "name": "CVE-2021-0953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
    },
    {
      "name": "CVE-2021-0926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
    },
    {
      "name": "CVE-2021-0961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2020-23064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
    },
    {
      "name": "CVE-2021-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
    },
    {
      "name": "CVE-2021-0339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
    },
    {
      "name": "CVE-2021-39627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
    },
    {
      "name": "CVE-2021-0437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2021-0433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
    },
    {
      "name": "CVE-2024-22041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22041"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2022-20473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
    },
    {
      "name": "CVE-2022-43947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
    },
    {
      "name": "CVE-2023-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41841"
    },
    {
      "name": "CVE-2021-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
    },
    {
      "name": "CVE-2022-20483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
    },
    {
      "name": "CVE-2020-25705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
    },
    {
      "name": "CVE-2024-22045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22045"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2023-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
    },
    {
      "name": "CVE-2021-0399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
    },
    {
      "name": "CVE-2023-33301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33301"
    },
    {
      "name": "CVE-2021-0476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
    },
    {
      "name": "CVE-2021-0507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
    },
    {
      "name": "CVE-2021-0390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
    },
    {
      "name": "CVE-2021-0444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
    },
    {
      "name": "CVE-2021-0520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
    },
    {
      "name": "CVE-2021-0586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
    },
    {
      "name": "CVE-2021-39633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
    },
    {
      "name": "CVE-2021-0587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
    },
    {
      "name": "CVE-2021-0952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
    },
    {
      "name": "CVE-2022-20476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
    },
    {
      "name": "CVE-2020-10768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
    },
    {
      "name": "CVE-2022-20472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
    },
    {
      "name": "CVE-2021-0326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
    },
    {
      "name": "CVE-2021-0929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
    },
    {
      "name": "CVE-2022-20227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
    },
    {
      "name": "CVE-2021-0336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
    },
    {
      "name": "CVE-2023-44250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44250"
    },
    {
      "name": "CVE-2021-0506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
    },
    {
      "name": "CVE-2021-0515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
    },
    {
      "name": "CVE-2022-20355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
    },
    {
      "name": "CVE-2021-0330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
    },
    {
      "name": "CVE-2021-0688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
    },
    {
      "name": "CVE-2021-0393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
    },
    {
      "name": "CVE-2024-21762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
    },
    {
      "name": "CVE-2021-0512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-20130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
    },
    {
      "name": "CVE-2021-0519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
    },
    {
      "name": "CVE-2021-0516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
    },
    {
      "name": "CVE-2021-39621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
    },
    {
      "name": "CVE-2021-33909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
    },
    {
      "name": "CVE-2022-42469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
    },
    {
      "name": "CVE-2021-1972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
    },
    {
      "name": "CVE-2021-1976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2021-0640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
    },
    {
      "name": "CVE-2020-14305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
    },
    {
      "name": "CVE-2023-36555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36555"
    },
    {
      "name": "CVE-2022-20422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
    },
    {
      "name": "CVE-2022-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
    },
    {
      "name": "CVE-2023-22640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22640"
    },
    {
      "name": "CVE-2021-0400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
    },
    {
      "name": "CVE-2022-20469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
    },
    {
      "name": "CVE-2020-26558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
    },
    {
      "name": "CVE-2021-0706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
    },
    {
      "name": "CVE-2021-0682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
    },
    {
      "name": "CVE-2021-0480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
    },
    {
      "name": "CVE-2021-0429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2021-0683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
    },
    {
      "name": "CVE-2022-20411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-33307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33307"
    },
    {
      "name": "CVE-2021-0328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
    },
    {
      "name": "CVE-2021-0684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
    },
    {
      "name": "CVE-2022-20466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
    },
    {
      "name": "CVE-2023-40718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40718"
    },
    {
      "name": "CVE-2021-0920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
    },
    {
      "name": "CVE-2021-0704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
    },
    {
      "name": "CVE-2022-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
    },
    {
      "name": "CVE-2021-0436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
    },
    {
      "name": "CVE-2021-0584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2021-0594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
    },
    {
      "name": "CVE-2021-0591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
    },
    {
      "name": "CVE-2021-0514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
    },
    {
      "name": "CVE-2021-0511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
    },
    {
      "name": "CVE-2021-0931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
    },
    {
      "name": "CVE-2024-21483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21483"
    },
    {
      "name": "CVE-2020-15436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
    },
    {
      "name": "CVE-2023-45793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45793"
    },
    {
      "name": "CVE-2021-0689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
    },
    {
      "name": "CVE-2023-28001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28001"
    },
    {
      "name": "CVE-2021-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
    },
    {
      "name": "CVE-2021-0337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
    },
    {
      "name": "CVE-2022-32257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32257"
    },
    {
      "name": "CVE-2023-36639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36639"
    },
    {
      "name": "CVE-2021-39623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
    },
    {
      "name": "CVE-2022-41330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
    },
    {
      "name": "CVE-2021-0508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
    },
    {
      "name": "CVE-2021-0325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
    },
    {
      "name": "CVE-2021-0708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
    },
    {
      "name": "CVE-2022-41334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41334"
    },
    {
      "name": "CVE-2024-23113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
    },
    {
      "name": "CVE-2020-0338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
    },
    {
      "name": "CVE-2020-26555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
    },
    {
      "name": "CVE-2021-0302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
    },
    {
      "name": "CVE-2021-0589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
    },
    {
      "name": "CVE-2021-0305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
    },
    {
      "name": "CVE-2023-33308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33308"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2021-0431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
    },
    {
      "name": "CVE-2021-0392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
    },
    {
      "name": "CVE-2021-0474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
    },
    {
      "name": "CVE-2021-0930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
    },
    {
      "name": "CVE-2021-39626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
    },
    {
      "name": "CVE-2021-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    },
    {
      "name": "CVE-2023-37935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37935"
    },
    {
      "name": "CVE-2021-0695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
    },
    {
      "name": "CVE-2024-22040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22040"
    },
    {
      "name": "CVE-2021-0965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
    },
    {
      "name": "CVE-2021-0513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
    },
    {
      "name": "CVE-2021-0434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
    },
    {
      "name": "CVE-2021-0687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
    },
    {
      "name": "CVE-2021-0481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
    },
    {
      "name": "CVE-2021-0964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
    },
    {
      "name": "CVE-2021-0641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
    },
    {
      "name": "CVE-2021-0435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
    },
    {
      "name": "CVE-2021-0334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
    },
    {
      "name": "CVE-2021-0933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
    },
    {
      "name": "CVE-2021-0394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    },
    {
      "name": "CVE-2021-0588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
    },
    {
      "name": "CVE-2023-38545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
    },
    {
      "name": "CVE-2024-22039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22039"
    },
    {
      "name": "CVE-2021-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
    },
    {
      "name": "CVE-2021-0510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
    },
    {
      "name": "CVE-2021-0692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
    },
    {
      "name": "CVE-2024-22044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22044"
    },
    {
      "name": "CVE-2020-14381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0203",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-792319 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-792319.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-918992 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-918992.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-353002 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-353002.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-653855 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-225840 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-225840.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-145196 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-145196.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-382651 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-382651.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-832273 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-366067 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-366067.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-770721 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-576771 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
    }
  ]
}

CERTFR-2023-AVI-0451

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.0.10
Fortinet	FortiSIEM	FortiSIEM versions antérieures à 7.0.0
Fortinet	FortiWeb	FortiWeb versions 7.2.x antérieures à 7.2.2
Fortinet	N/A	FortiConverter versions 6.x antérieures à 6.2.2
Fortinet	FortiManager	FortiManager versions 7.2.x antérieures à 7.2.2
Fortinet	FortiNAC	FortiNAC versions 8.x à 9.1.x antérieures à 9.1.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.4.x antérieures à 6.4.12
Fortinet	N/A	FortiADCManager versions 5.x à 7.0.x antérieures à 7.0.1
Fortinet	FortiNAC	FortiNAC versions 9.2.x antérieures à 9.2.8
Fortinet	FortiNAC	FortiNAC versions 9.4.x antérieures à 9.4.3
Fortinet	FortiOS	FortiOS versions 6.x à 7.0.x antérieures à 7.0.12
Fortinet	FortiManager	FortiManager versions 6.4.x antérieures à 6.4.12
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.2.x antérieures à 7.2.2
Fortinet	N/A	FortiClientWindows versions 6.4.x antérieures à 6.4.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.2
Fortinet	FortiManager	FortiManager versions 7.0.x antérieures à 7.0.7
Fortinet	N/A	FortiConverter versions 7.0.x antérieures à 7.0.1
Fortinet	FortiOS	FortiOS-6K7K versions 6.0.x antérieures à 6.0.17
Fortinet	FortiNAC	FortiNAC-F versions 7.2.x antérieures à 7.2.1
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.5
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.15
Fortinet	FortiWeb	FortiWeb versions 6.x à 7.0.x antérieures à 7.0.7
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.0.x antérieures à 7.0.2
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.13
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.4
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.12
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.7
Fortinet	FortiADC	FortiADC versions 5.x à 7.1.x antérieures à 7.1.3
Fortinet	N/A	FortiClientWindows versions 7.0.x antérieures à 7.0.7
Fortinet	FortiADC	FortiADC versions 7.2.x antérieures à 7.2.1
Fortinet	N/A	FortiADCManager versions antérieures à 7.1.1
Fortinet	FortiPAM	FortiPAM versions antérieures à 1.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité FG-IR-22-380 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-076 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-494 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-21-141 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-111 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-521 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-229 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-125 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-097 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-107 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-259 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-468 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-258 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-095 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-463 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-23-119 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-393 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-375 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-455 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-493 du 12 juin 2023	None	vendor-advisory
Bulletin de sécurité FG-IR-22-332 du 12 juin 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiProxy versions ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSIEM versions ant\u00e9rieures \u00e0 7.0.0",
      "product": {
        "name": "FortiSIEM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiConverter versions 6.x ant\u00e9rieures \u00e0 6.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 8.x \u00e0 9.1.x ant\u00e9rieures \u00e0 9.1.9",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADCManager versions 5.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.8",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.3",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitchManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiSwitchManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions 6.4.x ant\u00e9rieures \u00e0 6.4.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiConverter versions 7.0.x ant\u00e9rieures \u00e0 7.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.0.x ant\u00e9rieures \u00e0 6.0.17",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC-F versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.5",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.15",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitchManager versions 7.0.x ant\u00e9rieures \u00e0 7.0.2",
      "product": {
        "name": "FortiSwitchManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADC versions 5.x \u00e0 7.1.x ant\u00e9rieures \u00e0 7.1.3",
      "product": {
        "name": "FortiADC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADC versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiADC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiADCManager versions ant\u00e9rieures \u00e0 7.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPAM versions ant\u00e9rieures \u00e0 1.0.0",
      "product": {
        "name": "FortiPAM",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-25609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25609"
    },
    {
      "name": "CVE-2023-22633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22633"
    },
    {
      "name": "CVE-2022-39946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39946"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2022-42478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42478"
    },
    {
      "name": "CVE-2022-33877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33877"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-26210",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26210"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2022-43949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43949"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2023-26204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26204"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-28000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28000"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0451",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nFortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-380 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-380"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-076 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-076"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-494 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-494"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-21-141 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-21-141"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-111 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-111"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-521 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-521"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-229 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-229"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-125 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-125"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-097 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-097"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-107 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-107"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-259 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-259"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-468 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-468"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-258 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-258"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-095 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-095"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-463 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-463"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-23-119 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-119"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-393 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-393"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-375 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-375"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-455 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-455"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-493 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-493"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FG-IR-22-332 du 12 juin 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-332"
    }
  ]
}

CERTFR-2024-AVI-0203

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	Cerberus PRO EN Engineering Tool versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8
Siemens	N/A	RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions
Siemens	N/A	Sinteso FS20 EN Engineering Tool versions antérieures à MP8
Siemens	N/A	SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.2
Siemens	N/A	Solid Edge versions antérieures à V223.0.11
Siemens	N/A	Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	SINEMA Remote Connect Client versions antérieures à V3.1 SP1
Siemens	N/A	SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Sinteso Mobile versions antérieures à V3.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité Siemens SSA-792319 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-918992 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-353002 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-653855 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-225840 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-145196 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-382651 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-832273 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-366067 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-770721 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-576771 du 12 mars 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cerberus PRO EN Engineering Tool versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Fire Panel FC20 versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM APE1808 avec Fortinet NGFW versions ant\u00e9rieures \u00e0 V7.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Engineering Tool versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF160B (6GT2003-0FA00) versions ant\u00e9rieures \u00e0 V2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Solid Edge versions ant\u00e9rieures \u00e0 V223.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Control versions sup\u00e9rieures ou \u00e9gales \u00e0 V2.8 versions ant\u00e9rieures \u00e0 V3.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN Fire Panel FC72x versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Client versions ant\u00e9rieures \u00e0 V3.1 SP1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso Mobile versions ant\u00e9rieures \u00e0 V3.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
    },
    {
      "name": "CVE-2017-18509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
    },
    {
      "name": "CVE-2021-0599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
    },
    {
      "name": "CVE-2021-0443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
    },
    {
      "name": "CVE-2022-20462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
    },
    {
      "name": "CVE-2021-0598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
    },
    {
      "name": "CVE-2021-0438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
    },
    {
      "name": "CVE-2021-0651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
    },
    {
      "name": "CVE-2021-0585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
    },
    {
      "name": "CVE-2021-0331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
    },
    {
      "name": "CVE-2021-0509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
    },
    {
      "name": "CVE-2021-0601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
    },
    {
      "name": "CVE-2021-0478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
    },
    {
      "name": "CVE-2021-0397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
    },
    {
      "name": "CVE-2021-0600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
    },
    {
      "name": "CVE-2021-0928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
    },
    {
      "name": "CVE-2021-0484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
    },
    {
      "name": "CVE-2023-36641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36641"
    },
    {
      "name": "CVE-2021-0642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
    },
    {
      "name": "CVE-2021-0341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2021-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
    },
    {
      "name": "CVE-2020-24587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
    },
    {
      "name": "CVE-2017-14491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
    },
    {
      "name": "CVE-2022-20421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
    },
    {
      "name": "CVE-2021-0593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
    },
    {
      "name": "CVE-2022-20498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
    },
    {
      "name": "CVE-2021-0473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2021-0870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
    },
    {
      "name": "CVE-2020-0417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
    },
    {
      "name": "CVE-2020-29660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
    },
    {
      "name": "CVE-2021-0604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
    },
    {
      "name": "CVE-2021-0522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
    },
    {
      "name": "CVE-2021-39629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
    },
    {
      "name": "CVE-2020-29661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
    },
    {
      "name": "CVE-2021-38204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
    },
    {
      "name": "CVE-2022-20229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
    },
    {
      "name": "CVE-2023-33306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33306"
    },
    {
      "name": "CVE-2022-39948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
    },
    {
      "name": "CVE-2022-20423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
    },
    {
      "name": "CVE-2021-0396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
    },
    {
      "name": "CVE-2021-0650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
    },
    {
      "name": "CVE-2021-0329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
    },
    {
      "name": "CVE-2023-41675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41675"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-29183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29183"
    },
    {
      "name": "CVE-2021-0471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2021-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
    },
    {
      "name": "CVE-2021-0327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
    },
    {
      "name": "CVE-2021-0653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
    },
    {
      "name": "CVE-2021-0690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
    },
    {
      "name": "CVE-2021-39634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
    },
    {
      "name": "CVE-2021-0596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
    },
    {
      "name": "CVE-2023-47537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
    },
    {
      "name": "CVE-2023-28002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28002"
    },
    {
      "name": "CVE-2023-22641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
    },
    {
      "name": "CVE-2021-0919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
    },
    {
      "name": "CVE-2021-0968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
    },
    {
      "name": "CVE-2022-20500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
    },
    {
      "name": "CVE-2021-29647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
    },
    {
      "name": "CVE-2021-0521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
    },
    {
      "name": "CVE-2020-11301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
    },
    {
      "name": "CVE-2021-0953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
    },
    {
      "name": "CVE-2021-0926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
    },
    {
      "name": "CVE-2021-0961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2020-23064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
    },
    {
      "name": "CVE-2021-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
    },
    {
      "name": "CVE-2021-0339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
    },
    {
      "name": "CVE-2021-39627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
    },
    {
      "name": "CVE-2021-0437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2021-0433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
    },
    {
      "name": "CVE-2024-22041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22041"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2022-20473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
    },
    {
      "name": "CVE-2022-43947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
    },
    {
      "name": "CVE-2023-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41841"
    },
    {
      "name": "CVE-2021-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
    },
    {
      "name": "CVE-2022-20483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
    },
    {
      "name": "CVE-2020-25705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
    },
    {
      "name": "CVE-2024-22045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22045"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2023-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
    },
    {
      "name": "CVE-2021-0399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
    },
    {
      "name": "CVE-2023-33301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33301"
    },
    {
      "name": "CVE-2021-0476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
    },
    {
      "name": "CVE-2021-0507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
    },
    {
      "name": "CVE-2021-0390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
    },
    {
      "name": "CVE-2021-0444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
    },
    {
      "name": "CVE-2021-0520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
    },
    {
      "name": "CVE-2021-0586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
    },
    {
      "name": "CVE-2021-39633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
    },
    {
      "name": "CVE-2021-0587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
    },
    {
      "name": "CVE-2021-0952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
    },
    {
      "name": "CVE-2022-20476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
    },
    {
      "name": "CVE-2020-10768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
    },
    {
      "name": "CVE-2022-20472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
    },
    {
      "name": "CVE-2021-0326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
    },
    {
      "name": "CVE-2021-0929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
    },
    {
      "name": "CVE-2022-20227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
    },
    {
      "name": "CVE-2021-0336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
    },
    {
      "name": "CVE-2023-44250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44250"
    },
    {
      "name": "CVE-2021-0506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
    },
    {
      "name": "CVE-2021-0515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
    },
    {
      "name": "CVE-2022-20355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
    },
    {
      "name": "CVE-2021-0330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
    },
    {
      "name": "CVE-2021-0688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
    },
    {
      "name": "CVE-2021-0393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
    },
    {
      "name": "CVE-2024-21762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
    },
    {
      "name": "CVE-2021-0512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-20130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
    },
    {
      "name": "CVE-2021-0519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
    },
    {
      "name": "CVE-2021-0516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
    },
    {
      "name": "CVE-2021-39621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
    },
    {
      "name": "CVE-2021-33909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
    },
    {
      "name": "CVE-2022-42469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
    },
    {
      "name": "CVE-2021-1972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
    },
    {
      "name": "CVE-2021-1976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2021-0640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
    },
    {
      "name": "CVE-2020-14305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
    },
    {
      "name": "CVE-2023-36555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36555"
    },
    {
      "name": "CVE-2022-20422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
    },
    {
      "name": "CVE-2022-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
    },
    {
      "name": "CVE-2023-22640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22640"
    },
    {
      "name": "CVE-2021-0400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
    },
    {
      "name": "CVE-2022-20469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
    },
    {
      "name": "CVE-2020-26558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
    },
    {
      "name": "CVE-2021-0706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
    },
    {
      "name": "CVE-2021-0682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
    },
    {
      "name": "CVE-2021-0480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
    },
    {
      "name": "CVE-2021-0429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2021-0683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
    },
    {
      "name": "CVE-2022-20411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-33307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33307"
    },
    {
      "name": "CVE-2021-0328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
    },
    {
      "name": "CVE-2021-0684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
    },
    {
      "name": "CVE-2022-20466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
    },
    {
      "name": "CVE-2023-40718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40718"
    },
    {
      "name": "CVE-2021-0920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
    },
    {
      "name": "CVE-2021-0704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
    },
    {
      "name": "CVE-2022-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
    },
    {
      "name": "CVE-2021-0436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
    },
    {
      "name": "CVE-2021-0584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2021-0594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
    },
    {
      "name": "CVE-2021-0591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
    },
    {
      "name": "CVE-2021-0514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
    },
    {
      "name": "CVE-2021-0511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
    },
    {
      "name": "CVE-2021-0931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
    },
    {
      "name": "CVE-2024-21483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21483"
    },
    {
      "name": "CVE-2020-15436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
    },
    {
      "name": "CVE-2023-45793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45793"
    },
    {
      "name": "CVE-2021-0689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
    },
    {
      "name": "CVE-2023-28001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28001"
    },
    {
      "name": "CVE-2021-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
    },
    {
      "name": "CVE-2021-0337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
    },
    {
      "name": "CVE-2022-32257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32257"
    },
    {
      "name": "CVE-2023-36639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36639"
    },
    {
      "name": "CVE-2021-39623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
    },
    {
      "name": "CVE-2022-41330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
    },
    {
      "name": "CVE-2021-0508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
    },
    {
      "name": "CVE-2021-0325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
    },
    {
      "name": "CVE-2021-0708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
    },
    {
      "name": "CVE-2022-41334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41334"
    },
    {
      "name": "CVE-2024-23113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
    },
    {
      "name": "CVE-2020-0338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
    },
    {
      "name": "CVE-2020-26555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
    },
    {
      "name": "CVE-2021-0302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
    },
    {
      "name": "CVE-2021-0589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
    },
    {
      "name": "CVE-2021-0305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
    },
    {
      "name": "CVE-2023-33308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33308"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2021-0431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
    },
    {
      "name": "CVE-2021-0392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
    },
    {
      "name": "CVE-2021-0474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
    },
    {
      "name": "CVE-2021-0930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
    },
    {
      "name": "CVE-2021-39626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
    },
    {
      "name": "CVE-2021-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    },
    {
      "name": "CVE-2023-37935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37935"
    },
    {
      "name": "CVE-2021-0695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
    },
    {
      "name": "CVE-2024-22040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22040"
    },
    {
      "name": "CVE-2021-0965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
    },
    {
      "name": "CVE-2021-0513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
    },
    {
      "name": "CVE-2021-0434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
    },
    {
      "name": "CVE-2021-0687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
    },
    {
      "name": "CVE-2021-0481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
    },
    {
      "name": "CVE-2021-0964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
    },
    {
      "name": "CVE-2021-0641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
    },
    {
      "name": "CVE-2021-0435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
    },
    {
      "name": "CVE-2021-0334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
    },
    {
      "name": "CVE-2021-0933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
    },
    {
      "name": "CVE-2021-0394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    },
    {
      "name": "CVE-2021-0588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
    },
    {
      "name": "CVE-2023-38545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
    },
    {
      "name": "CVE-2024-22039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22039"
    },
    {
      "name": "CVE-2021-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
    },
    {
      "name": "CVE-2021-0510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
    },
    {
      "name": "CVE-2021-0692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
    },
    {
      "name": "CVE-2024-22044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22044"
    },
    {
      "name": "CVE-2020-14381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0203",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-792319 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-792319.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-918992 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-918992.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-353002 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-353002.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-653855 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-225840 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-225840.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-145196 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-145196.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-382651 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-382651.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-832273 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-366067 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-366067.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-770721 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-576771 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
    }
  ]
}

BDU:2023-03157 (CVE-2023-27997)

Vulnerability from fstec – Published: 2023-06-13 – Updated: 2024-09-24 – View on bdu.fstec.ru Exploit publicly available Yes Fixed

CISA ENISA Previdian

Title

Уязвимость SSL-VPN-портала операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость SSL-VPN-портала операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy связана с возможностью переполнения буфера на основе кучи. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код путём отправки специально сформированных запросов

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Yes

Remediation

Software update

CWE

CWE-122 - Переполнение буфера в динамической памяти

Aliases

CVE-2023-27997, FG-IR-23-097

References

3 references

URL
https://www.fortiguard.com/psirt/FG-IR-23-097
https://vuldb.com/?id.231296
https://bishopfox.com/blog/cve-2023-27997-exploitable-fortigate-vulnerable

Impacted products

3 products from 1 vendor

Vendors

Fortinet Inc.

Products

FortiOS-6K7K, FortiProxy, FortiOS

Versions

6.4.2 (FortiOS-6K7K), 6.4.6 (FortiOS-6K7K), 1.1 (FortiProxy), 1.2 (FortiProxy), от 6.0.0 до 6.0.16 включительно (FortiOS), от 6.2.0 до 6.2.13 включительно (FortiOS), 6.0.10 (FortiOS-6K7K), 6.0.12 (FortiOS-6K7K), 6.0.13 (FortiOS-6K7K), 6.0.14 (FortiOS-6K7K), 6.0.15 (FortiOS-6K7K), 6.0.16 (FortiOS-6K7K), 6.2.10 (FortiOS-6K7K), 6.2.11 (FortiOS-6K7K), 6.2.12 (FortiOS-6K7K), 6.2.13 (FortiOS-6K7K), 6.2.4 (FortiOS-6K7K), 6.2.6 (FortiOS-6K7K), 6.2.7 (FortiOS-6K7K), 6.2.9 (FortiOS-6K7K), 6.4.10 (FortiOS-6K7K), 6.4.12 (FortiOS-6K7K), 6.4.8 (FortiOS-6K7K), от 7.2.0 до 7.2.3 включительно (FortiProxy), от 7.0.0 до 7.0.9 включительно (FortiProxy), от 2.0.0 до 2.0.12 включительно (FortiProxy), от 7.2.0 до 7.2.4 включительно (FortiOS), от 7.0.0 до 7.0.11 включительно (FortiOS), от 6.4.0 до 6.4.12 включительно (FortiOS)

Product types

Operating system, Security device, Security software

Platforms

Fortinet Inc. FortiOS-6K7K 6.4.2, Fortinet Inc. FortiOS-6K7K 6.4.6, Fortinet Inc. FortiOS от 6.0.0 до 6.0.16 включительно, Fortinet Inc. FortiOS от 6.2.0 до 6.2.13 включительно, Fortinet Inc. FortiOS-6K7K 6.0.10, Fortinet Inc. FortiOS-6K7K 6.0.12, Fortinet Inc. FortiOS-6K7K 6.0.13, Fortinet Inc. FortiOS-6K7K 6.0.14, Fortinet Inc. FortiOS-6K7K 6.0.15, Fortinet Inc. FortiOS-6K7K 6.0.16, Fortinet Inc. FortiOS-6K7K 6.2.10, Fortinet Inc. FortiOS-6K7K 6.2.11, Fortinet Inc. FortiOS-6K7K 6.2.12, Fortinet Inc. FortiOS-6K7K 6.2.13, Fortinet Inc. FortiOS-6K7K 6.2.4, Fortinet Inc. FortiOS-6K7K 6.2.6, Fortinet Inc. FortiOS-6K7K 6.2.7, Fortinet Inc. FortiOS-6K7K 6.2.9, Fortinet Inc. FortiOS-6K7K 6.4.10, Fortinet Inc. FortiOS-6K7K 6.4.12, Fortinet Inc. FortiOS-6K7K 6.4.8, Fortinet Inc. FortiOS от 7.2.0 до 7.2.4 включительно, Fortinet Inc. FortiOS от 7.0.0 до 7.0.11 включительно, Fortinet Inc. FortiOS от 6.4.0 до 6.4.12 включительно

Mitigations

Установка обновлений из доверенных источников. В связи со сложившейся обстановкой и введенными санкциями против Российской Федерации рекомендуется устанавливать обновления программного обеспечения только после оценки всех сопутствующих рисков. Компенсирующие меры: - отключение SSL-VPN; - использование систем обнаружения и предотвращения вторжений для отслеживания попыток доступа к устройству; - использование средств межсетевого экранирования для формирования «белого» списка адресов, которым разрешён удаленный доступ. Использование рекомендаций производителя: https://www.fortiguard.com/psirt/FG-IR-23-097

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fortinet Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "6.4.2 (FortiOS-6K7K), 6.4.6 (FortiOS-6K7K), 1.1 (FortiProxy), 1.2 (FortiProxy), \u043e\u0442 6.0.0 \u0434\u043e 6.0.16 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 6.2.0 \u0434\u043e 6.2.13 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), 6.0.10 (FortiOS-6K7K), 6.0.12 (FortiOS-6K7K), 6.0.13 (FortiOS-6K7K), 6.0.14 (FortiOS-6K7K), 6.0.15 (FortiOS-6K7K), 6.0.16 (FortiOS-6K7K), 6.2.10 (FortiOS-6K7K), 6.2.11 (FortiOS-6K7K), 6.2.12 (FortiOS-6K7K), 6.2.13 (FortiOS-6K7K), 6.2.4 (FortiOS-6K7K), 6.2.6 (FortiOS-6K7K), 6.2.7 (FortiOS-6K7K), 6.2.9 (FortiOS-6K7K), 6.4.10 (FortiOS-6K7K), 6.4.12 (FortiOS-6K7K), 6.4.8 (FortiOS-6K7K), \u043e\u0442 7.2.0 \u0434\u043e 7.2.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.0.0 \u0434\u043e 7.0.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 2.0.0 \u0434\u043e 2.0.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 7.2.0 \u0434\u043e 7.2.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.0.0 \u0434\u043e 7.0.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 6.4.0 \u0434\u043e 6.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 SSL-VPN;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u00ab\u0431\u0435\u043b\u043e\u0433\u043e\u00bb \u0441\u043f\u0438\u0441\u043a\u0430 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.fortiguard.com/psirt/FG-IR-23-097",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.06.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "13.06.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-03157",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-27997, FG-IR-23-097",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FortiOS-6K7K, FortiProxy, FortiOS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Fortinet Inc. FortiOS-6K7K 6.4.2 , Fortinet Inc. FortiOS-6K7K 6.4.6 , Fortinet Inc. FortiOS \u043e\u0442 6.0.0 \u0434\u043e 6.0.16 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 6.2.0 \u0434\u043e 6.2.13 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS-6K7K 6.0.10 , Fortinet Inc. FortiOS-6K7K 6.0.12 , Fortinet Inc. FortiOS-6K7K 6.0.13 , Fortinet Inc. FortiOS-6K7K 6.0.14 , Fortinet Inc. FortiOS-6K7K 6.0.15 , Fortinet Inc. FortiOS-6K7K 6.0.16 , Fortinet Inc. FortiOS-6K7K 6.2.10 , Fortinet Inc. FortiOS-6K7K 6.2.11 , Fortinet Inc. FortiOS-6K7K 6.2.12 , Fortinet Inc. FortiOS-6K7K 6.2.13 , Fortinet Inc. FortiOS-6K7K 6.2.4 , Fortinet Inc. FortiOS-6K7K 6.2.6 , Fortinet Inc. FortiOS-6K7K 6.2.7 , Fortinet Inc. FortiOS-6K7K 6.2.9 , Fortinet Inc. FortiOS-6K7K 6.4.10 , Fortinet Inc. FortiOS-6K7K 6.4.12 , Fortinet Inc. FortiOS-6K7K 6.4.8 , Fortinet Inc. FortiOS \u043e\u0442 7.2.0 \u0434\u043e 7.2.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 7.0.0 \u0434\u043e 7.0.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 6.4.0 \u0434\u043e 6.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SSL-VPN-\u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (CWE-122)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SSL-VPN-\u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043a\u0443\u0447\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0443\u0442\u0451\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.fortiguard.com/psirt/FG-IR-23-097\nhttps://vuldb.com/?id.231296\nhttps://bishopfox.com/blog/cve-2023-27997-exploitable-fortigate-vulnerable",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-122",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CNVD-2024-26328

Vulnerability from cnvd - Published: 2024-06-05

Title

Fortinet FortiOS远程代码执行漏洞

Description

Fortinet FortiOS是美国飞塔（Fortinet）公司的一套专用于FortiGate网络安全平台上的安全操作系统。该系统为用户提供防火墙、防病毒、IPSec/SSLVPN、Web内容过滤和反垃圾邮件等多种安全功能。 Fortinet FortiOS存在安全漏洞，该漏洞源于基于堆的缓冲区溢出漏洞。未经身份认证的攻击者可利用该漏洞远程执行代码。

Severity

高

Formal description

目前厂商尚未发布升级补丁以修复这个安全问题，请到厂商的主页下载：
https://docs.fortinet.com/product/fortigate/6.0

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-27997

Impacted products

Name
['Fortinet FortiProxy >=1.1.0，<=1.1.6', 'Fortinet FortiProxy >=1.2.0，<=1.2.13', 'Fortinet FortiProxy >=2.0.0，<=2.0.12', 'Fortinet FortiOS >=7.2.0，<=7.2.4', 'Fortinet FortiProxy >=7.0.0，<=7.0.9', 'Fortinet FortiProxy >=7.2.0，<=7.2.3', 'Fortinet FortiOS >=7.0.0，<=7.0.11', 'Fortinet FortiOS >=6.0.0，<=6.0.16', 'Fortinet FortiOS >=6.4.0，<=6.4.12', 'Fortinet FortiOS >=6.2.0，<=6.2.13']

Name

['Fortinet FortiProxy >=1.1.0，<=1.1.6', 'Fortinet FortiProxy >=1.2.0，<=1.2.13', 'Fortinet FortiProxy >=2.0.0，<=2.0.12', 'Fortinet FortiOS >=7.2.0，<=7.2.4', 'Fortinet FortiProxy >=7.0.0，<=7.0.9', 'Fortinet FortiProxy >=7.2.0，<=7.2.3', 'Fortinet FortiOS >=7.0.0，<=7.0.11', 'Fortinet FortiOS >=6.0.0，<=6.0.16', 'Fortinet FortiOS >=6.4.0，<=6.4.12', 'Fortinet FortiOS >=6.2.0，<=6.2.13']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-27997",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997"
    }
  },
  "description": "Fortinet FortiOS\u662f\u7f8e\u56fd\u98de\u5854\uff08Fortinet\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8eFortiGate\u7f51\u7edc\u5b89\u5168\u5e73\u53f0\u4e0a\u7684\u5b89\u5168\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u4e3a\u7528\u6237\u63d0\u4f9b\u9632\u706b\u5899\u3001\u9632\u75c5\u6bd2\u3001IPSec/SSLVPN\u3001Web\u5185\u5bb9\u8fc7\u6ee4\u548c\u53cd\u5783\u573e\u90ae\u4ef6\u7b49\u591a\u79cd\u5b89\u5168\u529f\u80fd\u3002\n\nFortinet FortiOS\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u57fa\u4e8e\u5806\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u672a\u7ecf\u8eab\u4efd\u8ba4\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a  \r\nhttps://docs.fortinet.com/product/fortigate/6.0",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-26328",
  "openTime": "2024-06-05",
  "products": {
    "product": [
      "Fortinet FortiProxy \u003e=1.1.0\uff0c\u003c=1.1.6",
      "Fortinet FortiProxy \u003e=1.2.0\uff0c\u003c=1.2.13",
      "Fortinet FortiProxy \u003e=2.0.0\uff0c\u003c=2.0.12",
      "Fortinet FortiOS \u003e=7.2.0\uff0c\u003c=7.2.4",
      "Fortinet FortiProxy \u003e=7.0.0\uff0c\u003c=7.0.9",
      "Fortinet FortiProxy \u003e=7.2.0\uff0c\u003c=7.2.3",
      "Fortinet FortiOS \u003e=7.0.0\uff0c\u003c=7.0.11",
      "Fortinet FortiOS \u003e=6.0.0\uff0c\u003c=6.0.16",
      "Fortinet FortiOS \u003e=6.4.0\uff0c\u003c=6.4.12",
      "Fortinet FortiOS \u003e=6.2.0\uff0c\u003c=6.2.13"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997",
  "serverity": "\u9ad8",
  "submitTime": "2023-06-16",
  "title": "Fortinet FortiOS\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

FKIE_CVE-2023-27997

Vulnerability from fkie_nvd - Published: 2023-06-13 09:15 - Updated: 2026-07-31 04:16

CISA ENISA Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@fortinet.com	https://fortiguard.com/psirt/FG-IR-23-097	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://fortiguard.com/psirt/FG-IR-23-097	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997	US Government Resource

Impacted products

Vendor	Product	Version
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	6.0.10
fortinet	fortios	6.2.4
fortinet	fortios	6.2.6
fortinet	fortios	6.2.7
fortinet	fortios	6.4.2
fortinet	fortios	6.4.6
fortinet	fortios	6.4.8
fortinet	fortios	6.4.10
fortinet	fortios	6.4.12
fortinet	fortios	7.0.5
fortinet	fortios	7.0.10
fortinet	fortigate_6000	-
fortinet	fortigate_7000	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "FortiOS-6K7K",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.10"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "6.4.12"
            },
            {
              "status": "affected",
              "version": "6.4.10"
            },
            {
              "status": "affected",
              "version": "6.4.8"
            },
            {
              "status": "affected",
              "version": "6.4.6"
            },
            {
              "status": "affected",
              "version": "6.4.2"
            },
            {
              "lessThanOrEqual": "6.2.13",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.7",
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2.4"
            },
            {
              "lessThanOrEqual": "6.0.16",
              "status": "affected",
              "version": "6.0.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.10"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.9",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.12",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.13",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.1.6",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.4",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.11",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.12",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.13",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.16",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "cisaActionDue": "2023-07-04",
  "cisaExploitAdd": "2023-06-13",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
              "versionEndIncluding": "1.1.6",
              "versionStartIncluding": "1.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
              "versionEndIncluding": "1.2.13",
              "versionStartIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C1D5E6B-A23E-4A92-B53C-720AFEB1B951",
              "versionEndIncluding": "2.0.12",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAC18F7E-5242-4F36-BB42-FEC33B3AC075",
              "versionEndIncluding": "7.0.9",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A99FF48-370E-4D2A-B5CC-889EA21AB213",
              "versionEndIncluding": "7.2.3",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EA5512D-6EE5-4DF3-A960-C02394F25225",
              "versionEndIncluding": "6.0.16",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CD57A5A-2B13-495A-8530-8F97E1720602",
              "versionEndIncluding": "6.2.13",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E99B6E5-7EC3-406C-AFAC-A5E32DE266DF",
              "versionEndIncluding": "6.4.12",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2573C90-BE6A-4D5D-A223-F09213318909",
              "versionEndIncluding": "7.0.11",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AB643A8-B52F-4D54-B816-28A6401BAA25",
              "versionEndIncluding": "7.2.4",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D997493-24C2-4A78-9DF0-6438E9415A3C",
              "versionEndIncluding": "6.0.16",
              "versionStartIncluding": "6.0.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A0D0D55-1A51-454D-A8B1-D7100D453102",
              "versionEndIncluding": "6.2.13",
              "versionStartIncluding": "6.2.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6AF1FA-A034-439A-876B-BFA1BE7DE15E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "9694FC0C-408A-4892-ADD1-F36F4BBBD9EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B8A132F-601F-4129-BFCA-3A976A711D5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "90600B14-07C4-455D-9FC1-17034D91B987",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B28478DA-8D10-4A8E-81EA-D3DF421E5089",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2F935F9-5B6A-47C2-8F65-7A1E8BB061FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "751D2FC7-482F-4C6B-95DB-244004A2738E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEE44B20-6F00-4962-9929-5A5054BBA94C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB2FF1DA-001B-4CA1-9F46-427D9C92CBC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "48D0E8CC-3815-4697-86D0-DC7F66E70520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "78C6C937-4477-438D-A252-E4102D758120",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BB410C9-CDD4-4068-97E0-6D83AE62B7F1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0CBA773-10C1-410D-BB01-771F454ABEBA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
    }
  ],
  "id": "CVE-2023-27997",
  "lastModified": "2026-07-31T04:16:43.707",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27997",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2023-06-12T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-06-13T09:15:16.613",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-23-097"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-23-097"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2HJ2-FCR9-9P35

Vulnerability from github – Published: 2023-06-13 09:30 – Updated: 2025-10-22 00:32

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-27997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-13T09:15:16Z",
    "severity": "CRITICAL"
  },
  "details": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.",
  "id": "GHSA-2hj2-fcr9-9p35",
  "modified": "2025-10-22T00:32:44Z",
  "published": "2023-06-13T09:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-23-097"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Solutions

CNA · fortinet

Please upgrade to FortiOS-6K7K version 7.0.12 or above Please upgrade to FortiOS-6K7K version 6.4.13 or above Please upgrade to FortiOS-6K7K version 6.2.15 or above Please upgrade to FortiOS-6K7K version 6.0.17 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.14 or above Please upgrade to FortiOS version 6.0.17 or above

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-27997 (GCVE-0-2023-27997)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Csirt Report Confirmed Compromise Confidence: 75% Source: enisa-cnw-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Confirmed Compromise Confidence: 70% Source: kevintel

Details

References

Solution

Solution

Solution

Solution

Solution

Solution

BDU:2023-03157 (CVE-2023-27997)

Solutions

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour