FortiWeb - Stack-Based Buffer Overflow vulnerability


A stack-based buffer overflow [CWE-121] vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the content of the stack and potentially execute arbitrary code by sending crafted HTTP requests with large request parameter values.

Affected Products

FortiWeb version 6.4.0 
FortiWeb versions 6.3.15 and below 
FortiWeb versions 6.2.5 and below


Please upgrade to FortiWeb versions 6.4.1 or above.
Please upgrade to FortiWeb versions 6.3.16 or above.
Please upgrade to FortiWeb versions 6.2.6 or above.


Fortinet is pleased to thank Andrey Medov of PTSecurity, Xiaojunjie Huang and Wenjie Zhong of DBAppSecurity for brining this issue to our attention under responsible disclosure.