Cyber Posture

CVE-2023-33302

Medium

Published: 31 March 2025

Published
31 March 2025
Modified
23 July 2025
KEV Added
Patch
CVSS Score 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0026 49.5th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-33302 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Fortinet Fortimail. Its CVSS base score is 4.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the buffer overflow vulnerability by requiring timely identification, reporting, and patching of the flaw in FortiMail and FortiNDR as per vendor advisory.

prevent

Validates size and structure of HTTP request inputs to external webmail and administrative interfaces, preventing buffer overflows from crafted oversized inputs.

prevent

Implements memory protections like address space randomization and non-executable stacks to mitigate successful exploitation of the buffer overflow for code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The buffer overflow in the webmail/administrative web interface allows authenticated attackers to trigger RCE via crafted HTTP requests, directly mapping to exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular…

more

webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.

Deeper analysisAI

CVE-2023-33302 is a classic buffer overflow vulnerability (CWE-120) stemming from a buffer copy without checking the size of input. It affects the webmail and administrative interface in Fortinet FortiMail versions 6.4.0 through 6.4.4 and before 6.2.6, as well as the administrative interface in FortiNDR version 7.2.0 and before 7.1.0. The issue has a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.

An authenticated attacker with regular webmail access can exploit this vulnerability over the network with low complexity and no user interaction required. By sending specifically crafted HTTP requests, the attacker can trigger the buffer overflow, potentially leading to execution of unauthorized code or commands.

Fortinet's advisory FG-IR-21-023, available at https://fortiguard.fortinet.com/psirt/FG-IR-21-023, provides details on the vulnerability, including recommended patches and mitigation steps.

Details

CWE(s)

Affected Products

fortinet
fortimail
5.4.0 — 5.4.12 · 6.0.0 — 6.0.11 · 6.2.0 — 6.2.7
fortinet
fortindr
1.1.0 — 7.2.1

CVEs Like This One

CVE-2023-47539Same product: Fortinet Fortimail
CVE-2021-26091Same product: Fortinet Fortimail
CVE-2025-24472Same vendor: Fortinet
CVE-2025-52970Same vendor: Fortinet
CVE-2025-64447Same vendor: Fortinet
CVE-2025-59719Same vendor: Fortinet
CVE-2025-59922Same vendor: Fortinet
CVE-2026-22627Same vendor: Fortinet
CVE-2023-48790Same product: Fortinet Fortindr
CVE-2025-54820Same vendor: Fortinet

References