CVE-2021-22123

🗓️ 01 Jun 2021 19:58:35Reported by fortinetType

cve🔗 web.nvd.nist.gov📰️ 14 Media mentions👁 120 Views🌐 WEB

An OS command injection vulnerability in FortiWeb's management interface

Reporter	Title	Published	Views	Family All 21
ATTACKERKB	CVE-2021-22123	1 Jun 202120:15	–	attackerkb
BDU FSTEC	The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.	29 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-22123	2 Jun 202106:43	–	circl
CNNVD	Fortinet FortiWeb 操作系统命令注入漏洞	1 Jun 202100:00	–	cnnvd
CNVD	FortiWeb OS Command Injection Vulnerability	2 Jun 202100:00	–	cnvd
Cvelist	CVE-2021-22123	1 Jun 202119:58	–	cvelist
GithubExploit	Exploit for OS Command Injection in Fortinet Fortiweb	18 Aug 202110:54	–	githubexploit
Fortinet	FortiWeb - OS command injection vulnerability	1 Jun 202100:00	–	fortinet
Tenable Nessus	Fortinet FortiWeb ] Restricted user can execute arbitrary commands with root privileges (OS command Injection). (FG-IR-20-120)	27 Oct 202400:00	–	nessus
Tenable Nessus	Fortinet FortiWeb OS command injection vulnerability (FG-IR-21-116)	26 Oct 202400:00	–	nessus

NVD

Vulners

Node

fortinet fortiwebRange5.9.0–6.2.4

fortinet fortiwebRange6.3.0–6.3.8

[
  {
    "product": "Fortinet FortiWeb",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWeb 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/advisory/FG-IR-20-120

Parameter	Position	Path	Description	CWE
name	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
q_type	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
entityID	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
service-path	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
session-lifetime	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
session-timeout	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
sso-bind	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
sso-bind_val	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
sso-path	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78
slo-bind	request body	/api/v2.0/user/remoteserver.saml	Authenticated OS command injection via the SAML server configuration page where the name field is tainted and can execute system commands as root.	CWE-78

17 Jun 2026 03:36Current

9.3High risk

Vulners AI Score9.3

CVSS 3.17.6 - 8.8

CVSS 29

EPSS0.7727

SSVC

CWE-78