What’s Vulnerable › Vulnerabilities
CVE-2023-33302
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-31 · updated 2026-06-17
- Weakness: CWE-120
Description
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
Affected products
- Fortinet FortiMail: from 5.4.0 through 5.4.12; from 6.0.0 before 6.0.11; from 6.2.0 before 6.2.7; from 6.4.0 before 6.4.5 — fixed in 6.0.11, 6.2.7, 6.4.5
- Fortinet FortiNDR: from 1.1.0 before 7.2.1 — fixed in 7.2.1
How to fix
Upgrade to a fixed version: Fortinet FortiMail 6.0.11, 6.2.7, 6.4.5; Fortinet FortiNDR 7.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-33302 or the next vulnerability affects your stack