Cyber Resilience

CVE-2023-45583

Medium

Published: 14 May 2024

Published
14 May 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-45583 is a medium-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Fortinet Fortios. Its CVSS base score is 6.7 (Medium).

Operationally, ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.5, 7.0.0 through 7.0.11, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 FortiPAM versions 1.1.0, 1.0.0 through 1.0.3 FortiOS versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13,…

more

6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.

CWE(s)
CWE-134

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

fortinet
fortiproxy
≤ 7.0.12 · 7.2.0 — 7.2.6
fortinet
fortiswitchmanager
7.0.0 — 7.0.3 · 7.2.0 — 7.2.3
fortinet
fortios
7.4.0 · ≤ 7.2.6 · 6.2.0 — 6.2.16 · 6.4.0 — 6.4.15
fortinet
fortipam
1.1.0 · 1.0.0 — 1.0.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References