FortiProxy vulnerabilities

55 known vulnerabilities in FortiProxy from Fortinet. 53 are rated high or critical, and 13 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  FortiProxy: Use of Externally-Controlled Format String

  CVE-2022-43953Jun 13, 2023Fortinet

  A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows at

• 8.8 High severity

  FortiOS: Out-of-bounds Write

  CVE-2023-22640May 3, 2023Fortinet

  A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.13, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7,

• 8.8 High severity

  FortiOS: Improper Restriction of Excessive Authentication Attempts

  CVE-2022-43947Apr 11, 2023Fortinet

  An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a v

• 9.8 Critical severity

  FortiPresence: Missing Authentication for Critical Functionality

  CVE-2022-41331Apr 11, 2023FortinetEPSS 1.27%

  A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

• 8.2 High severity

  FortiOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-42476Mar 7, 2023Fortinet

  A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, For

• 8.1 High severity

  FortiSwitchManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-41335Feb 16, 2023Fortinet

  A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 al

• 7.4 High severity

  FortiProxy: Improper Certificate Validation

  CVE-2022-39948Feb 16, 2023Fortinet

  An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and u

• 9.8 Critical severity

  Fortinet FortiOS Heap-Based Buffer Overflow Exploited

  CVE-2022-42475Jan 2, 2023FortinetEPSS 99.5%

  A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote un

• 9.8 Critical severity

  FortiOS: Improper Authentication

  CVE-2022-35843Dec 6, 2022Fortinet

  An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 thro

• 7.5 High severity

  Fortinet FortiOS, FortiProxy: Access of Uninitialized Pointer

  CVE-2022-29055Oct 18, 2022FortinetEPSS 1.13%

  A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated atta

• 9.8 Critical severity

  Fortinet Multiple Products Authentication Bypass Exploited

  CVE-2022-40684Oct 18, 2022FortinetEPSS 100%

  An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an una

• 7.8 High severity

  Fortinet FortiADC, FortiProxy, FortiMail…: Use of Externally-Controlled Format String

  CVE-2022-22299Aug 5, 2022Fortinet

  A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 throug

• 7.5 High severity

  Fortinet FortiOS and FortiProxy Improper Authorization Exploited

  CVE-2018-13382Jun 4, 2019FortinetEPSS 81.7%

  An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the passwo

• 9.8 Critical severity

  Fortinet FortiOS SSL VPN Path Traversal Exploited

  CVE-2018-13379Jun 4, 2019FortinetEPSS 100%

  An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an una

• 6.5 Medium severity

  Fortinet FortiOS and FortiProxy Out-of-bounds Write Exploited

  CVE-2018-13383May 29, 2019FortinetEPSS 30.7%

  A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users d