CVE-2023-37933

High

Published: 11 March 2025

Published

11 March 2025

Modified

22 July 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0040 61.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-37933 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Fortinet Fortiadc. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2023-37933 is a cross-site scripting (XSS) vulnerability stemming from improper neutralization of input during web page generation (CWE-79) in the FortiADC GUI. It affects FortiADC GUI version 7.4.0, versions 7.2.0 through 7.2.1, and all versions before 7.1.3. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low complexity, no privileges required, and potential for high confidentiality, integrity, and availability impacts given user interaction.

An authenticated attacker can exploit this vulnerability by sending crafted HTTP or HTTPS requests to the FortiADC GUI, enabling an XSS attack. Although the CVSS vector specifies no privileges required (PR:N), the vulnerability description confirms that authentication is necessary. Successful exploitation allows the attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise depending on user privileges.

For mitigation details, refer to the FortiGuard advisory FG-IR-23-216 at https://fortiguard.com/psirt/FG-IR-23-216, which provides guidance on patches and workarounds.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-41786

Vulnerability details

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

XSS in public-facing FortiADC GUI web app enables arbitrary browser script execution, directly mapping to exploitation of public-facing applications (T1190) and browser session hijacking (T1185) via stolen cookies or session takeover.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0