Buffer overflow in Fortinet Fortiproxy, Fortios
CVE-2019-17656
A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.
Vulnerability class: Buffer Overflow
EPSS: 0.016 (72.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Fortinet Fortiproxy, Fortios — versions FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below; FortiOS 6.0.10 and below, 6.2.2 and below
- Fortinet Fortios
- Fortinet Fortiproxy
Weakness classification (CWE)
References
- psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-17656?
- CVE-2019-17656 is a medium-severity vulnerability in Fortinet Fortiproxy, Fortios, classified under Out-of-bounds Write. CVSS score: 5.4/10. Published 2021-04-12.
- How severe is CVE-2019-17656?
- Medium severity. CVSS v3 base score is 5.4 out of 10.