CVE-2023-45584

A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-23-209	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios:7.4.0:::::::*

Configuration 2 (hide)

cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::
	cpe:2.3:a:fortinet:fortiproxy::::::::

History

14 Aug 2025, 01:03

Type	Values Removed	Values Added
CPE		cpe:2.3:o:fortinet:fortios:::::::: cpe:2.3:a:fortinet:fortiproxy:::::::: cpe:2.3:o:fortinet:fortipam:::::::: cpe:2.3:o:fortinet:fortios:7.4.0:::::::*
References	~~() https://fortiguard.fortinet.com/psirt/FG-IR-23-209 -~~	() https://fortiguard.fortinet.com/psirt/FG-IR-23-209 - Vendor Advisory
First Time		Fortinet fortipam Fortinet fortios Fortinet fortiproxy Fortinet

13 Aug 2025, 17:33

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de doble liberación [CWE-415] en Fortinet FortiOS versión 7.4.0, versión 7.2.0 a 7.2.5 y anteriores a 7.0.12, FortiProxy versión 7.4.0 a 7.4.1, versión 7.2.0 a 7.2.7 y anteriores a 7.0.13 y FortiPAM versión 1.1.0 a 1.1.2 y anteriores a 1.0.3 permite a un atacante privilegiado ejecutar código o comandos a través de solicitudes HTTP o HTTPS manipuladas.

12 Aug 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-12 19:15

Updated : 2025-08-14 01:03

NVD link : CVE-2023-45584

Mitre link : CVE-2023-45584

CVE.ORG link : CVE-2023-45584

JSON object : View

Products Affected

fortinet

fortipam
fortios
fortiproxy

CWE

CWE-415

Double Free

{"id": "CVE-2023-45584", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-08-12T19:15:27.020", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-209", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests."}, {"lang": "es", "value": "Una vulnerabilidad de doble liberaci\u00f3n [CWE-415] en Fortinet FortiOS versi\u00f3n 7.4.0, versi\u00f3n 7.2.0 a 7.2.5 y anteriores a 7.0.12, FortiProxy versi\u00f3n 7.4.0 a 7.4.1, versi\u00f3n 7.2.0 a 7.2.7 y anteriores a 7.0.13 y FortiPAM versi\u00f3n 1.1.0 a 1.1.2 y anteriores a 1.0.3 permite a un atacante privilegiado ejecutar c\u00f3digo o comandos a trav\u00e9s de solicitudes HTTP o HTTPS manipuladas."}], "lastModified": "2025-08-14T01:03:40.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44EB484E-505B-4DB2-86EC-17881A4F2674", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E323817-A339-48C3-B21A-851F1631F14B", "versionEndExcluding": "7.2.6", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61540F5B-080A-4D44-8BE0-75D7A0DCCB53"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D7A0B61-B88B-4C6B-994D-762BF2585F3A", "versionEndIncluding": "1.1.2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86607BB0-08AB-4E78-913D-B783949D5C1D", "versionEndExcluding": "7.0.14", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "469D97BA-282C-4875-A156-FDA00B5B4093", "versionEndExcluding": "7.2.8", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8AA0CE6-3E57-47D9-8318-215F0C4A2031", "versionEndExcluding": "7.4.2", "versionStartIncluding": "7.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}