Fortinet FortiWeb up to 7.4.0 URL neutralization for logs

Summaryinfo

A vulnerability has been found in Fortinet FortiWeb up to 6.2.8/6.3.23/7.0.10/7.2.5/7.4.0 and classified as problematic. Affected is an unknown function of the component URL Handler. This manipulation causes neutralization for logs. This vulnerability appears as CVE-2023-46713. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Fortinet FortiWeb up to 6.2.8/6.3.23/7.0.10/7.2.5/7.4.0 and classified as problematic. Affected by this vulnerability is an unknown part of the component URL Handler. The manipulation with an unknown input leads to a neutralization for logs vulnerability. The CWE definition for the vulnerability is CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. As an impact it is known to affect integrity. The summary by CVE is:

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application.

The weakness was presented 12/13/2023 as FG-IR-23-256. The advisory is shared at fortiguard.com. This vulnerability is known as CVE-2023-46713 since 10/25/2023. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Fortinet

Name

• FortiWeb

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 6.3.6
• 6.3.7
• 6.3.8
• 6.3.9
• 6.3.10
• 6.3.11
• 6.3.12
• 6.3.13
• 6.3.14
• 6.3.15
• 6.3.16
• 6.3.17
• 6.3.18
• 6.3.19
• 6.3.20
• 6.3.21
• 6.3.22
• 6.3.23
• 7.0
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.1
• 7.2
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.3
• 7.4.0

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion