CVE-2021-22123

🗓️ 01 Jun 2021 19:58:35Reported by fortinetType

cve🔗 web.nvd.nist.gov📰️ 14 Media mentions👁 105 Views🌐 WEB

An OS command injection vulnerability in FortiWeb's management interface

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.	29 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-22123	2 Jun 202106:43	–	circl
CNNVD	Fortinet FortiWeb 操作系统命令注入漏洞	1 Jun 202100:00	–	cnnvd
CNVD	FortiWeb OS Command Injection Vulnerability	2 Jun 202100:00	–	cnvd
Cvelist	CVE-2021-22123	1 Jun 202119:58	–	cvelist
GithubExploit	Exploit for OS Command Injection in Fortinet Fortiweb	18 Aug 202110:54	–	githubexploit
Fortinet	FortiWeb - OS command injection vulnerability	1 Jun 202100:00	–	fortinet
Tenable Nessus	Fortinet FortiWeb ] Restricted user can execute arbitrary commands with root privileges (OS command Injection). (FG-IR-20-120)	27 Oct 202400:00	–	nessus
Tenable Nessus	Fortinet FortiWeb OS command injection vulnerability (FG-IR-21-116)	26 Oct 202400:00	–	nessus
NCSC	Vulnerability fixed in FortiWeb	19 Aug 202100:00	–	ncsc

NVD

Node

fortinet fortiwebRange5.9.0–6.2.4

fortinet fortiwebRange6.3.0–6.3.8

[
  {
    "product": "Fortinet FortiWeb",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWeb 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/advisory/FG-IR-20-120

Parameter	Position	Path	Description	CWE
name	request body	api/v2.0/user/remoteserver.saml	Authenticated OS command injection via SAML server configuration page using backticks in the 'name' field (PoC shown).	CWE-78

21 Nov 2024 05:49Current

9.3High risk

Vulners AI Score9.3

CVSS 3.17.6 - 8.8

CVSS 29

EPSS0.80497

SSVC

CWE-78