WARNING: NEW RCE VULNERABILITIES AFFECTING FORTIWEB, FORTIPROXY AND FORTIOS, PATCH AND VERIFY YOUR SYSTEMS ASAP!
CVSS score: 7.3 (high)
FortiNet released a security fix to patch two vulnerabilities leading to remote code execution. Both vulnerabilities have a high impact on all vertices of the CIA triad (Confidentiality, Integrity, Availability).
The US Cybersecurity and Infrastructure Security Agency (CISA) warns that exploitation of these flaws could lead to full system compromise.
The Centre for Cyber security Belgium recommends system administrators to patch vulnerable systems as soon as possible and to analyze system and network logs for any suspicious activity. If your organization has already identified an intrusion or incident, please report it via: https://cert.be/en/report-incident.
CVE-2023-34984 is a failure in the protection mechanism of FortiWeb, a web application firewall from FortiNet. Successfully exploiting this vulnerability may allow an attacker to bypass XSS (cross-site scripting) and CSRF (cross-site request forgery) protections.
The Centre for Cyber Security Belgium strongly recommends upgrading your software:
Upgrade to FortiWeb version 7.2.2 or above
Upgrade to FortiWeb version 7.0.7 or above
Upgrade to FortiProxy version 7.2.5 or above
Upgrade to FortiProxy version 7.0.11 or above
Upgrade to FortiOS version 7.4.0 or above
Upgrade to FortiOS version 7.2.5 or above
Upgrade to FortiOS version 7.0.12 or above
Upgrade to FortiOS version 6.4.13 or above
Upgrade to FortiOS version 6.2.15 or above