Monthly PSIRT Advisories refers to an Advisories Report that Fortinet’s Product Security Incident Response Team (PSIRT) team rolls out every month. The report provides a list of advisories for vulnerabilities resolved in Fortinet products. Considering its importance, we have decided to publish a monthly breakdown of the Fortinet Monthly PSIRT Advisory Report on thesecmaster.com. We are going to cover the March 2023 Monthly PSIRT Advisory Report this time and going forward. You are going to see the same report for upcoming months on this website.

Summary of March 2023 Monthly PSIRT Advisory Report:

Fortinet released the March 2023 Monthly PSIRT Advisory Report early this week. Let’s see the summary of the report:

• The report listed 15 vulnerabilities this time, of which 1 is classified as critical, 5 are classified as High, 8 are Medium, and 1 is Low in severity.
• The Critical vulnerability identified is CVE-2023-25610, which is a Heap Buffer Underflow vulnerability in FortiOS & FortiProxy administrative interface that may allow a remote unauthenticated attacker to execute arbitrary code on the device and/or perform a DoS on the GUI via specifically crafted requests.
• The products affected by this list of 15 vulnerabilities may include FortiOS, FortiProxy, FortiAnalyzer, FortiWeb, FortiNAC, FortiRecorder, FortiManager, FortiMail, FortiPortal, FortiAuthenticator, FortiSwitch, FortiSOAR, FortiDeceptor, and FortiOS-6K7K.

Vulnerabilities by Category: 

All 15 vulnerabilities are categorized into 16 different vulnerabilities. Command injection is the most frequently identified vulnerability, appearing 7 times in the March 2023 Monthly PSIRT Advisory Report. Command injection is a web security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application and typically fully compromises the application and all its data. Buffer overflows, and cryptographic vulnerabilities are the next most frequently identified vulnerability types, appearing 6 times each. Path traversal vulnerabilities appear 5 times, and cross-site scripting (XSS) vulnerabilities appear 4 times. Please see this table which provides information on the number of various vulnerability types identified in the March 2023 Monthly PSIRT Advisory Report.

Vulnerabilities by Product:

Please refer to this table if you want to know the list of vulnerabilities by the Fortinet products.

List of Critical Vulnerabilities- March 2023 Monthly PSIRT Advisory Report:

The severity of the identified vulnerabilities is measured in the CVSS score. CVSS is a scale measured from 0 to 10 where 0 is the least severe and 10 is the most severe Vulnerability. All the vulnerabilities are assigned a CVSS number between 0.0 to 10.10 depending on several factors, including the attack vector, the attack complexity, and the impact on confidentiality, integrity, and availability. The vulnerabilities assigned the CVSS score between 0 to 4 are labeled ‘Low’ severity. The vulnerabilities assigned the CVSS score between 4 to 7 are labeled ‘Medium’ severity. Similarly, the vulnerabilities assigned a CVSS score between 7 to 8 are labeled ‘High’ severity, and the CVSS score between 9 to 10 is ‘Critical’ in severity.

The below table lists the vulnerabilities considered Critical in severity.

Comprehensive List of Vulnerabilities Patched in March 2023 Monthly PSIRT Advisory Report: 

We have segregated the list into multiple lists by the Applications. You can refer to the complete list of the official Fortinet security updates here. 

FortiOS

FortiProxy

FortiAnalyzer

FortiWeb

FortiNac

Fortirecorder

FortiManager

FortiMail

FortiPortal

FortiAuthenticator

FortiAuthenticator

FortiSOAR

FortiDeceptor

FortiOS-6k7k

We hope this post would help you know about the March 2023 Monthly PSIRT Advisory Report published by Fortinet on 7th March 2023. Please share this post and help secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• Breaking Down the Latest February 2023 Monthly PSIRT Advisory Report From Fortinet
• How to Fix CVE-2022-40684- A Critical Authentication Bypass Vulnerability in FortiGate and FortiProxy
• How to Fix the New Security Bypass Vulnerabilities in Fortinet Products
• How to Fix CVE-2022-42475- A Critical Buffer Overflow Vulnerability in FortiOS SSL-VPN
• How To Fix CVE-2022-39952 & CVE-2021-42756- Two Critical Arbitrary Code Execution Vulnerabilities in Fortinet Products