What is CVE-2023-22641?

CVE-2023-22641 is a medium-severity vulnerability in Fortinet Fortios, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.1/10. Published 2023-04-11.

How severe is CVE-2023-22641?

Medium severity. CVSS v3 base score is 4.1 out of 10.

Open Redirect in Fortinet Fortios

CVE-2023-22641

A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.

Vulnerability class: Open Redirect

EPSS: 0.003 (22.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N.

Affected products

Fortinet Fortios — versions 7.2.0, 7.0.0, 6.4.0
Fortinet Fortiproxy — versions 7.2.0, 7.0.0, 2.0.0

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-22641?: CVE-2023-22641 is a medium-severity vulnerability in Fortinet Fortios, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.1/10. Published 2023-04-11.
How severe is CVE-2023-22641?: Medium severity. CVSS v3 base score is 4.1 out of 10.