CVE-2021-22123

🗓️ 01 Jun 2021 19:58:35Reported by fortinetType

cve🔗 web.nvd.nist.gov📰️ 14 Media mentions👁 122 Views🌐 WEB

An OS command injection vulnerability in FortiWeb's management interface

Reporter	Title	Published	Views	Family All 21
attackerkb	CVE-2021-22123	1 Jun 202120:15	–	attackerkb
BDU FSTEC	The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.	29 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-22123	2 Jun 202106:43	–	circl
CNNVD	Fortinet FortiWeb 操作系统命令注入漏洞	1 Jun 202100:00	–	cnnvd
CNVD	FortiWeb OS Command Injection Vulnerability	2 Jun 202100:00	–	cnvd
Cvelist	CVE-2021-22123	1 Jun 202119:58	–	cvelist
GithubExploit	Exploit for OS Command Injection in Fortinet Fortiweb	18 Aug 202110:54	–	githubexploit
Fortinet	FortiWeb - OS command injection vulnerability	1 Jun 202100:00	–	fortinet
Tenable Nessus	Fortinet FortiWeb ] Restricted user can execute arbitrary commands with root privileges (OS command Injection). (FG-IR-20-120)	27 Oct 202400:00	–	nessus
Tenable Nessus	Fortinet FortiWeb OS command injection vulnerability (FG-IR-21-116)	26 Oct 202400:00	–	nessus

NVD

Vulners

Node

fortinet fortiwebRange5.9.0–6.2.4

fortinet fortiwebRange6.3.0–6.3.8

[
  {
    "product": "Fortinet FortiWeb",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWeb 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/advisory/FG-IR-20-120

Parameter	Position	Path	Description	CWE
name	request body	api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML Server configuration name field (backticks) leading to system() execution as root.	CWE-78

17 Jun 2026 03:36Current

9.3Critical risk

Vulners AI Score9.3

CVSS 3.17.6 - 8.8

CVSS 29

EPSS0.7727

SSVC

CWE-78