CVE-2023-42784 is a medium severity flaw (CVSS 5.6) in Fortinet FortiWeb. Improper handling of syntactically invalid structure lets an unauthenticated attacker bypass web firewall protections with crafted HTTP or HTTPS requests. Fortinet fixes it in FortiWeb 7.4.7 and later, and requires extra steps to enable the fix.
What's affected
Fortinet advisory FG-IR-23-115 was published on 11 March 2025 and updated on 13 March 2025. It covers two flaws, this one and CVE-2024-55594, and lists:
- FortiWeb 7.6: not affected.
- FortiWeb 7.4: 7.4.0 through 7.4.6 are affected. Upgrade to 7.4.7 or above.
- FortiWeb 7.2: all versions affected. Migrate to a fixed release.
- FortiWeb 7.0: all versions affected. Migrate to a fixed release.
- FortiWeb 6.4: not affected.
The record lists FortiWeb 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10. Fortinet marks Known Exploited as No.
How to check if you're exposed
Read the version on each FortiWeb with the command line:
get system status
Then check whether the fix is switched on, because Fortinet lists mandatory steps after upgrading. In summary, they are: update to the latest FortiGuard Distribution Service (FDS) signature package, approve signature 050240001, enable that signature policy in the web protection profile, and create a file security rule and policy with signature detection enabled and attach them. Follow the exact steps in the Fortinet advisory for your version, since menu paths can differ.
A FortiWeb that runs 7.4.7 but never had these steps applied does not have the protection the advisory describes.
What to do now
- List all FortiWeb appliances and their versions.
- Upgrade 7.4 units to 7.4.7 or later, and plan migration for 7.2 and 7.0 units to a fixed release.
- Apply the mandatory steps from the Fortinet advisory, including the signature update and file security policy.
- Test that the protection profile is attached to the policies that protect your applications.
- Do not rely on the web application firewall as the only control. Fix the applications behind it as well.
Why it matters
The weakness is improper handling of a syntactically invalid structure (CWE-228). A web application firewall inspects requests and decides what to block. If it parses a malformed request differently from the application behind it, content that looks harmless to the firewall can be read as an attack by the server. The gap between the two parsers is where bypasses live.
The score of 5.6 reflects the vector: network reachable, no login, high complexity, and low impact on each of confidentiality, integrity and availability. The advisory text describes the effect as a bypass of web firewall protections, while its impact line reads execute unauthorized code or commands. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is upgrading to 7.4.7 enough?
Fortinet lists mandatory steps to enable the fix, including a signature update and a file security policy. Read the advisory and apply them.
What about FortiWeb 7.2 and 7.0?
All versions are listed as affected, and Fortinet says to migrate to a fixed release.
Sources
Last reviewed: 19 October 2026.
