CVE-2022-27483

2022-07-1914:15:08

CWE-78

[email protected]

web.nvd.nist.gov

fortinet

fortimanager

fortianalyzer

cve-2022-27483

command injection

security vulnerability

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

48.4%

JSON

A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as root user via diagnose system CLI commands.

Affected configurations

NVD

Node

fortinetfortianalyzerRange6.0.0–6.0.11

fortinetfortianalyzerRange6.2.0–6.2.9

fortinetfortianalyzerRange6.4.0–6.4.7

fortinetfortianalyzerRange7.0.0–7.0.3

fortinetfortimanagerRange6.0.0–6.0.11

fortinetfortimanagerRange6.2.0–6.2.9

fortinetfortimanagerRange6.4.0–6.4.7

fortinetfortimanagerRange7.0.0–7.0.3

CPENameOperatorVersion
fortinet:fortianalyzerfortinet fortianalyzerle6.0.11
fortinet:fortianalyzerfortinet fortianalyzerle6.2.9
fortinet:fortianalyzerfortinet fortianalyzerle6.4.7
fortinet:fortianalyzerfortinet fortianalyzerle7.0.3
fortinet:fortimanagerfortinet fortimanagerle6.0.11
fortinet:fortimanagerfortinet fortimanagerle6.2.9
fortinet:fortimanagerfortinet fortimanagerle6.4.7
fortinet:fortimanagerfortinet fortimanagerle7.0.3

CPE	Name	Operator	Version
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.0.11
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.2.9
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.4.7
fortinet:fortianalyzer	fortinet fortianalyzer	le	7.0.3
fortinet:fortimanager	fortinet fortimanager	le	6.0.11
fortinet:fortimanager	fortinet fortimanager	le	6.2.9
fortinet:fortimanager	fortinet fortimanager	le	6.4.7
fortinet:fortimanager	fortinet fortimanager	le	7.0.3

CNA Affected

[
  {
    "product": "Fortinet FortiManager, FortiAnalyzer",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiManager 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0; FortiAnalyzer 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0"
      }
    ]
  }
]