Cyber Resilience

CVE-2023-25603

Fortinet Fortiddos-F 6.3.0 – 6.3.4

Published
14 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0040 32th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2023-25603 is a medium-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Fortinet Fortiddos-F. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests.

CWE(s)
CWE-942

Related Threats

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-29177Same product: Fortinet Fortiadc
CVE-2025-58412Same product: Fortinet Fortiadc
CVE-2023-37933Same product: Fortinet Fortiadc
CVE-2024-36511Same product: Fortinet Fortiadc
CVE-2023-50179Same product: Fortinet Fortiadc
CVE-2023-50178Same product: Fortinet Fortiadc
CVE-2023-50180Same product: Fortinet Fortiadc
CVE-2025-54971Same product: Fortinet Fortiadc
CVE-2026-39815Same product: Fortinet Fortiddos-F
CVE-2023-27999Same product: Fortinet Fortiadc

Affected Assets

fortinet
fortiadc
7.1.0, 7.1.1
fortinet
fortiddos-f
6.4.0, 6.4.1 · 6.3.0 — 6.3.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.4.3
  • V3.4.6
  • V3.5.2

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.

PR.PS-06 mostly match
prevents

Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.

ID.RA-01 partial match
prevents

Vulnerability identification processes can surface permissive policy misconfigurations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.

A.8.20 Networks security partial match
degrades

Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.

A.8.21 Security of network services partial match
degrades

Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.

A.8.23 Web filtering partial match
degrades

Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.

A.8.26 Application security requirements partial match
prevents

Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.

References