CVE-2023-36641

MediumCVSS 6.5/10Last modified Oct 22, 2026

Description

A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.4, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specifically crafted HTTP requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-197

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	7.4.0; >= 7.2.0, <= 7.2.5; >= 7.0.0, <= 7.0.12; >= 6.4.0, <= 6.4.16; >= 6.2.0, <= 6.2.17; >= 6.0.0, <= 6.0.18
Fortinet	FortiProxy	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.10; >= 2.0.0, <= 2.0.14; >= 1.2.1, <= 1.2.13; 01.02.00; >= 1.1.4, <= 1.1.6; >= 01.01.00, <= 01.01.03; >= 01.00.00, <= 01.00.07

References

https://fortiguard.com/psirt/FG-IR-23-151Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-151Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Oct 22, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-366427.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 CVE-2023-366435.3Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow compon CVE-2023-366445.3Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the CVE-2023-366459.8SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer funct CVE-2023-366468.8Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to CVE-2023-366477.5A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to imp CVE-2023-366488.2Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read pot CVE-2023-366499.1Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to im CVE-2023-36657.8A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component CVE-2023-366507.2A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux use CVE-2023-366517.2Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consu CVE-2023-366524.3A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read datab