Fortinet has recently released its July 2023 Monthly PSIRT Advisory Report on 11th July 2023, which we’ve covered in this detailed report. This report describes newly released security vulnerabilities affecting Fortinet products. The report is an essential resource for IT professionals and organizations utilizing Fortinet products, as it helps them stay informed about potential risks, allowing them to take the necessary actions to ensure their systems remain secure.
Through this report, you will understand the severity of each vulnerability, the steps needed to mitigate the risks, and take the necessary actions to enhance the security structure against potential threats. IT professionals and organizations are encouraged to closely monitor Fortinet’s PSIRT Advisories and adapt their security measures based on the findings. By staying up-to-date on the latest vulnerabilities and fixes, users can continue to leverage Fortinet’s cutting-edge technologies while maintaining a secure and robust digital infrastructure.
Summary of July 2023 Monthly PSIRT Advisory Report
Key highlights:
- 4 vulnerabilities have been identified in total. Among these, 1 is critical, 1 has high severity, and 2 are of medium severity.
- The critical vulnerability found in FortiOS and FortiProxy could potentially allow an attacker to execute arbitrary code due to a stack-based buffer overflow.
- The products affected by these vulnerabilities include FortiOS, FortiProxy, FortiExtender, FortiAnalyzer, and FortiManager.
Vulnerabilities by Category
The July 2023 Monthly PSIRT Advisory Report presents 4 vulnerabilities affecting multiple FortiGate products. Below is a table giving the overview of each vulnerability type identified in the report:
| Vulnerability Type | Number of Occurrences |
| Stack-based overflow vulnerability [CWE-124] | 1 |
| Path Traversal vulnerability [CWE-22] | 2 |
| Insufficient session expiration [CWE-613] vulnerability | 1 |
Vulnerabilities by Product
Please refer to this table if you want to know the list of vulnerabilities by the Fortinet products.
| Fortinet Product | Number of Occurrence |
| FortiOS | 2 |
| FortiProxy | 1 |
| FortiAnalyzer | 1 |
| FortiExtender | 1 |
| FortiManager | 1 |
List of Vulnerabilities Patched in July 2023 Monthly PSIRT Advisory Report
This table shows the breakdown of all 4 vulnerabilities published in the July 2023 Monthly PSIRT Advisory Report.
| CVE | Summary | CVSSv3 Score | Severity | Products Affected | Product Fixed |
| CVE-2023-33308 | A stack-based overflow vulnerability [CWE-124] in FortiOS & FortiProxy may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection. | 9.8 | Critical | FortiOS version 7.2.0 through 7.2.3FortiOS version 7.0.0 through 7.0.10FortiProxy version 7.2.0 through 7.2.2FortiProxy version 7.0.0 through 7.0.9 | Please upgrade to FortiOS version 7.4.0 or abovePlease upgrade to FortiOS version 7.2.4 or abovePlease upgrade to FortiOS version 7.0.11 or abovePlease upgrade to FortiProxy version 7.2.3 or abovePlease upgrade to FortiProxy version 7.0.10 or above |
| CVE-2022-23447 | An improper limitation of a pathname to a restricted directory Path Traversal vulnerability [CWE-22] in FortiExtender management interface may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. | 7.3 | High | FortiExtender version 7.0.0 through 7.0.3FortiExtender version 4.2.0 through 4.2.4FortiExtender version 4.1.1 through 4.1.8FortiExtender version 4.0.0 through 4.0.2FortiExtender version 3.3.0 through 3.3.2FortiExtender version 3.2.1 through 3.2.3FortiExtender 5.3 all versions | Please upgrade to FortiExtender version 7.2.0 or abovePlease upgrade to FortiExtender version 7.0.4 or abovePlease upgrade to FortiExtender version 4.2.5 or abovePlease upgrade to FortiExtender version 4.1.9 or abovePlease upgrade to FortiExtender version 4.0.3 or abovePlease upgrade to FortiExtender version 3.3.3 or abovePlease upgrade to FortiExtender version 3.2.4 or above |
| CVE-2023-28001 | An insufficient session expiration [CWE-613] vulnerability in FortiOS REST API may allow an attacker to reuse the session of a deleted user, should the attacker manage to obtain the API token. | 4.1 | Medium | FortiOS version 7.2.0 through 7.2.4FortiOS 7.0 all versions | Please upgrade to FortiOS version 7.4.0 or abovePlease upgrade to FortiOS version 7.2.5 or above |
| CVE-2023-25606 | An improper limitation of a pathname to a restricted directory Path Traversal vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface may allow a remote and authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. | 6.2 | Medium | FortiManager version 7.2.0 through 7.2.1FortiManager version 7.0.0 through 7.0.5FortiManager version 6.4.0 through 6.4.11FortiAnalyzer version 7.2.0 through 7.2.1FortiAnalyzer version 7.0.0 through 7.0.5FortiAnalyzer version 6.4.0 through 6.4.11 | Please upgrade to FortiManager version 7.2.2 or abovePlease upgrade to FortiManager version 7.0.7 or abovePlease upgrade to FortiManager version 6.4.12 or abovePlease upgrade to FortiAnalyzer version 7.2.2 or abovePlease upgrade to FortiAnalyzer version 7.0.7 or abovePlease upgrade to FortiAnalyzer version 6.4.12 or above |