CVE-2023-33305 Denial of service in FortiOS
Attackers can cause a denial of service in Fortinet network security products by sending specially crafted HTTP requests that trigger an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33305?
CVE-2023-33305 is a medium-severity denial of service vulnerability in Fortinet Fortios, published on 13 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.
Weakness: CWE-835
Which versions are affected by CVE-2023-33305?
It affects 3 products.
Products include Fortinet Fortios, Fortinet Fortiproxy, Fortinet Fortiweb.
How do I fix CVE-2023-33305?
No fix has been published for CVE-2023-33305 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-33305 being exploited?
There is no known exploitation of CVE-2023-33305 in the wild and no public exploit code.
Other vulnerabilities in Fortinet Fortios
Sources
Also known as GHSA-vrv2-gjv8-mw36.