CVE-2023-42784
Published: 11 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2023-42784 is an improper handling of syntactically invalid structures (CWE-228) vulnerability affecting Fortinet FortiWeb in versions 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The issue stems from inadequate validation of crafted HTTP/S requests, enabling attackers to execute unauthorized code or commands.
Remote attackers require no privileges or user interaction to exploit this over the network (AV:N/PR:N/UI:N), but it demands high attack complexity (AC:H) with unchanged scope (S:U). Successful exploitation yields low impacts across confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 5.6.
Mitigation details, including patches, are outlined in the Fortinet PSIRT advisory FG-IR-23-115 at https://fortiguard.fortinet.com/psirt/FG-IR-23-115.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows remote code/command execution on a public-facing FortiWeb web application firewall via crafted HTTP/S requests with no authentication required, directly enabling exploitation of public-facing applications.