{"id":"CVE-2023-42784","aliases":["EUVD-2023-47214","GHSA-5wr9-jp8m-f367"],"status":"published","title":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4...","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00382,"percentile":0.32605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-228"],"published":"2025-03-11T14:54:28Z","modified":"2026-06-17T06:24:29Z","products":[{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-115","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42784"},{"url":"https://github.com/advisories/GHSA-5wr9-jp8m-f367"}],"sources":{"cve":[{"id":"CVE-2023-42784","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-11T14:54:28.924Z","modified":"2025-03-11T16:10:57.143Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium","assessor":"cna"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-47214","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-11T14:54:28Z","modified":"2025-03-11T16:10:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium"}],"updated_at":"2026-11-02T20:53:07.365753Z"}],"ghsa":[{"id":"GHSA-5wr9-jp8m-f367","title":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4...","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-11T15:31:01Z","modified":"2025-03-11T15:31:08Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T15:00:12.792548Z"}],"nvd":[{"id":"CVE-2023-42784","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-11T15:15:40.033Z","modified":"2026-06-17T06:24:29.723Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:09:20.080574Z"}]}}