{"id":"CVE-2023-25602","state":"PUBLISHED","title":"A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier,","description":"A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.","publishedAt":"2023-02-16T18:05:47.402Z","updatedAt":"2024-10-23T14:48:20.993Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiWeb"],"affected":[{"vendor":"Fortinet","product":"FortiWeb","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.2","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.17","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.6","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.7","versionType":"semver"},{"version":"5.9.0","status":"affected","lessThanOrEqual":"5.9.1","versionType":"semver"},{"version":"5.8.5","status":"affected","lessThanOrEqual":"5.8.7","versionType":"semver"},{"version":"5.8.0","status":"affected","lessThanOrEqual":"5.8.3","versionType":"semver"},{"version":"5.7.0","status":"affected","lessThanOrEqual":"5.7.3","versionType":"semver"},{"version":"5.6.0","status":"affected","lessThanOrEqual":"5.6.2","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-21-234"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/25xxx/CVE-2023-25602.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-25602","state":"PUBLISHED","datePublished":"2023-02-16T18:05:47.402Z","dateUpdated":"2024-10-23T14:48:20.993Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-02-08T13:42:03.366Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments."}],"affected":[{"vendor":"Fortinet","product":"FortiWeb","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.2","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.17","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.6","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.7","versionType":"semver"},{"version":"5.9.0","status":"affected","lessThanOrEqual":"5.9.1","versionType":"semver"},{"version":"5.8.5","status":"affected","lessThanOrEqual":"5.8.7","versionType":"semver"},{"version":"5.8.0","status":"affected","lessThanOrEqual":"5.8.3","versionType":"semver"},{"version":"5.7.0","status":"affected","lessThanOrEqual":"5.7.3","versionType":"semver"},{"version":"5.6.0","status":"affected","lessThanOrEqual":"5.6.2","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-21-234","name":"https://fortiguard.com/psirt/FG-IR-21-234"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-02-16T18:05:47.402Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiWeb version 7.0.0 or above\r\nPlease upgrade to FortiWeb version 6.3.18 or above\r\nPlease upgrade to FortiWeb version 6.2.7 or above\r\nPlease upgrade to FortiWeb version 6.1.3 or above\r\nPlease upgrade to FortiWeb version 6.0.8 or above\r\nPlease upgrade to FortiWeb version 5.9.2 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-21-234","name":"https://fortiguard.com/psirt/FG-IR-21-234","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:25:19.297Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:11:56.827430Z","id":"CVE-2023-25602","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T14:48:20.993Z"}}]}}}