CVE-2023-33302
Published: 31 March 2025
Summary
CVE-2023-33302 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Fortinet Fortimail. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-33302 is a classic buffer overflow vulnerability (CWE-120) stemming from a buffer copy without checking the size of input. It affects the webmail and administrative interface in Fortinet FortiMail versions 6.4.0 through 6.4.4 and before 6.2.6, as well as the administrative interface in FortiNDR version 7.2.0 and before 7.1.0. The issue has a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L), indicating medium severity.
An authenticated attacker with regular webmail access can exploit this vulnerability over the network with low complexity and no user interaction required. By sending specifically crafted HTTP requests, the attacker can trigger the buffer overflow, potentially leading to execution of unauthorized code or commands.
Fortinet's advisory FG-IR-21-023, available at https://fortiguard.fortinet.com/psirt/FG-IR-21-023, provides details on the vulnerability, including recommended patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37465
Vulnerability details
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular…
more
webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The buffer overflow in the webmail/administrative web interface allows authenticated attackers to trigger RCE via crafted HTTP requests, directly mapping to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow vulnerability by requiring timely identification, reporting, and patching of the flaw in FortiMail and FortiNDR as per vendor advisory.
Validates size and structure of HTTP request inputs to external webmail and administrative interfaces, preventing buffer overflows from crafted oversized inputs.
Implements memory protections like address space randomization and non-executable stacks to mitigate successful exploitation of the buffer overflow for code execution.