{"id":"CVE-2023-33308","state":"PUBLISHED","title":"A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through","description":"A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.","publishedAt":"2023-07-26T14:00:25.931Z","updatedAt":"2024-10-23T13:07:25.250Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiProxy","Fortinet FortiOS"],"affected":[{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.2","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-183"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/33xxx/CVE-2023-33308.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-33308","state":"PUBLISHED","datePublished":"2023-07-26T14:00:25.931Z","dateUpdated":"2024-10-23T13:07:25.250Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-05-22T07:58:22.197Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection."}],"affected":[{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.2","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-183","name":"https://fortiguard.com/psirt/FG-IR-23-183"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-07-26T14:00:25.931Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiOS version 7.4.0 or above\r\nPlease upgrade to FortiOS version 7.2.4 or above\r\nPlease upgrade to FortiOS version 7.0.11 or above\r\nPlease upgrade to FortiProxy version 7.2.3 or above\r\nPlease upgrade to FortiProxy version 7.0.10 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-183","name":"https://fortiguard.com/psirt/FG-IR-23-183","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:39:36.270Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T13:07:14.340046Z","id":"CVE-2023-33308","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T13:07:25.250Z"}}]}}}