Authenticated user null pointer dereference in SSL-VPN Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-23-015 Final 1 1 2023-06-16T00:00:00 Current version 2023-06-16T00:00:00 2023-06-16T00:00:00 A NULL pointer dereference vulnerability [CWE-476] in SSL-VPN may allow an authenticated remote attacker to trigger a crash of the SSL-VPN service via crafted requests. None Denial of service FortiProxy version 7.2.0 through 7.2.3FortiProxy version 7.0.0 through 7.0.9FortiProxy 2.0 all versions are not affectedFortiProxy 1.2 all versions are not affectedFortiProxy 1.1 all versions are not affectedFortiOS 7.4 all versions are not affectedFortiOS version 7.2.0 through 7.2.4FortiOS version 7.0.0 through 7.0.10FortiOS version 6.4.0 through 6.4.12FortiOS 6.2 all versions are not affected Please upgrade to FortiOS version 7.4.0 or abovePlease upgrade to FortiOS version 7.2.5 or abovePlease upgrade to FortiOS version 7.0.11 or abovePlease upgrade to FortiOS version 6.4.13 or abovePlease upgrade to FortiProxy version 7.2.4 or abovePlease upgrade to FortiProxy version 7.0.10 or above Fortinet thanks to Aliz Hammond of watchTowr and NimdaKey of 360 Noah Lab for reporting this vulnerability. FortiOS 7.2.4 FortiOS 7.2.3 FortiOS 7.2.2 FortiOS 7.2.1 FortiOS 7.2.0 FortiOS 7.0.10 FortiOS 7.0.9 FortiOS 7.0.8 FortiOS 7.0.7 FortiOS 7.0.6 FortiOS 7.0.5 FortiOS 7.0.4 FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.12 FortiOS 6.4.11 FortiOS 6.4.10 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiProxy 7.2.3 FortiProxy 7.2.2 FortiProxy 7.2.1 FortiProxy 7.2.0 FortiProxy 7.0.9 FortiProxy 7.0.8 FortiProxy 7.0.7 FortiProxy 7.0.6 FortiProxy 7.0.5 FortiProxy 7.0.4 FortiProxy 7.0.3 FortiProxy 7.0.2 FortiProxy 7.0.1 FortiProxy 7.0.0 CVE-2023-33306 CVE-2023-33307 FortiOS-7.2.4 FortiOS-7.2.3 FortiOS-7.2.2 FortiOS-7.2.1 FortiOS-7.2.0 FortiOS-7.0.10 FortiOS-7.0.9 FortiOS-7.0.8 FortiOS-7.0.7 FortiOS-7.0.6 FortiOS-7.0.5 FortiOS-7.0.4 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.12 FortiOS-6.4.11 FortiOS-6.4.10 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiProxy-7.2.3 FortiProxy-7.2.2 FortiProxy-7.2.1 FortiProxy-7.2.0 FortiProxy-7.0.9 FortiProxy-7.0.8 FortiProxy-7.0.7 FortiProxy-7.0.6 FortiProxy-7.0.5 FortiProxy-7.0.4 FortiProxy-7.0.3 FortiProxy-7.0.2 FortiProxy-7.0.1 FortiProxy-7.0.0 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-23-015 Authenticated user null pointer dereference in SSL-VPN Reference>