CVE-2023-23783

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-22-187	Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-187	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortiweb::::::::
	cpe:2.3:a:fortinet:fortiweb::::::::

History

28 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Un uso de cadena de formato controlada externamente en Fortinet FortiWeb versiones 7.0.0 a 7.0.1, FortiWeb 6.4 en todas sus versiones permite al atacante ejecutar código o comandos no autorizados a través de argumentos de comando especialmente diseñados.

Information

Published : 2023-02-16 19:15

Updated : 2026-10-28 19:10

NVD link : CVE-2023-23783

Mitre link : CVE-2023-23783

CVE.ORG link : CVE-2023-23783

JSON object : View

Products Affected

fortinet

fortiweb

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2023-23783", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-23783", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-10-23T14:11:54.179721Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"vendor": "Fortinet", "product": "FortiWeb", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.1"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.2"}], "defaultStatus": "unaffected"}]}], "published": "2023-02-16T19:15:14.450", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-187", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}, {"url": "https://fortiguard.com/psirt/FG-IR-22-187", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-134"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments."}, {"lang": "es", "value": "Un uso de cadena de formato controlada externamente en Fortinet FortiWeb versiones 7.0.0 a 7.0.1, FortiWeb 6.4 en todas sus versiones permite al atacante ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de argumentos de comando especialmente dise\u00f1ados."}], "lastModified": "2026-10-28T19:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C97F7E3F-4747-46AA-8D2C-5D7C363CDB14", "versionEndExcluding": "6.4.2", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9054E8B0-2CF0-4DD3-8D5A-34C399F7C20D", "versionEndExcluding": "7.0.2", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}