CVE-2023-29180

HighCVSS 7.5/10Last modified Oct 22, 2026

Description

A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0.0 through 2.0.12, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specially crafted HTTP requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.11; >= 6.4.0, <= 6.4.12; >= 6.2.0, <= 6.2.14; >= 6.0.0, <= 6.0.16
Fortinet	FortiProxy	>= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.10; >= 2.0.0, <= 2.0.12; >= 1.2.1, <= 1.2.13; 01.02.00; >= 1.1.4, <= 1.1.6; >= 01.01.00, <= 01.01.03; >= 01.00.00, <= 01.00.07
fortinet	fortios	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.11; >= 6.4.0, <= 6.4.12; >= 6.2.0, <= 6.2..14; >= 6.0.0, <= 6.0.16
fortinet	fortiproxy	>= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.10; >= 2.0.0, <= 2.0.12; >= 1.2.0, <= 1.2.13; >= 1.1.0, <= 1.1.6; >= 1.0.0, <= 1.0.7

References

https://fortiguard.com/psirt/FG-IR-23-111Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-111Vendor Advisory

Timeline

Published: Feb 22, 2024
Last modified: Oct 22, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-291818.8A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.CVE-2023-291826.7A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary cod CVE-2023-291835.4An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7 CVE-2023-291842.3An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.CVE-2023-291856.5SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an atta CVE-2023-291866.5In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and CVE-2023-291876.7A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, r CVE-2023-291885.4SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WE CVE-2023-291895.4SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authen CVE-2023-29194.3The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missi CVE-2023-291924.3SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by othe CVE-2023-291937.5SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Th