description: A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions,  FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.
problem types: Denial of service
affected:
{
vendor: Fortinet
product: FortiWeb
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.1, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.6, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.3, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.23, status: affected
}
{
vendor: Fortinet
product: FortiOS
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.4, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.10, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.13, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.15, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.17, status: affected
versionType: semver, version: 5.6.0, lessThanOrEqual: 5.6.14, status: affected
versionType: semver, version: 5.4.0, lessThanOrEqual: 5.4.13, status: affected
versionType: semver, version: 5.2.0, lessThanOrEqual: 5.2.15, status: affected
versionType: semver, version: 5.0.0, lessThanOrEqual: 5.0.14, status: affected
}
{
vendor: Fortinet
product: FortiProxy
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.3, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.9, status: affected
versionType: semver, version: 2.0.0, lessThanOrEqual: 2.0.12, status: affected
versionType: semver, version: 1.2.0, lessThanOrEqual: 1.2.13, status: affected
versionType: semver, version: 1.1.0, lessThanOrEqual: 1.1.6, status: affected
versionType: semver, version: 1.0.0, lessThanOrEqual: 1.0.7, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C
]
solutions: Please upgrade to FortiPAM version 1.0.0 or above
Please upgrade to FortiWeb version 7.2.2 or above
Please upgrade to FortiWeb version 7.0.7 or above
Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.5 or above
Please upgrade to FortiOS version 7.0.11 or above
Please upgrade to FortiProxy version 7.2.4 or above
Please upgrade to FortiProxy version 7.0.10 or above