CVE-2023-37930

Description

Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities in Fortinet FortiOS SSL VPN webmode version 7.4.0, version 7.2.0 through 7.2.5, version 7.0.1 through 7.0.11 and version 6.4.7 through 6.4.14 and Fortinet FortiProxy SSL VPN webmode version 7.2.0 through 7.2.6 and version 7.0.0 through 7.0.12 allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.

Reserved 2023-07-11 | Published 2025-04-08 | Updated 2025-04-09 | Assigner fortinet

Problem types

Execute unauthorized code or commands

Product status

Default status
unaffected

7.4.0
affected

7.2.0
affected

7.0.1
affected

6.4.7
affected

Default status
unaffected

7.2.0
affected

7.0.0
affected

References

fortiguard.com/psirt/FG-IR-23-165

cve.org (CVE-2023-37930)

nvd.nist.gov (CVE-2023-37930)

Download JSON