Lucene search

FortinetCVE-2022-27489

HistoryFeb 16, 2023 - 7:15 p.m.

CVE-2022-27489

2023-02-1619:15:12

CWE-78

fortinet

web.nvd.nist.gov

cve-2022-27489

fortinet

fortiextender

os command injection

security vulnerability

nvd

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

Affected configurations

Nvd

Node

fortinetfortiextender_firmwareRange3.2.1–3.2.4

fortinetfortiextender_firmwareRange3.3.0–3.3.3

fortinetfortiextender_firmwareRange4.1.1–4.1.9

fortinetfortiextender_firmwareRange4.2.0–4.2.5

fortinetfortiextender_firmwareRange7.0.0–7.0.4

fortinetfortiextender_firmwareMatch3.0.0

fortinetfortiextender_firmwareMatch3.0.1

fortinetfortiextender_firmwareMatch3.0.2

fortinetfortiextender_firmwareMatch3.1.0

fortinetfortiextender_firmwareMatch3.1.1

fortinetfortiextender_firmwareMatch5.3.2

AND

fortinetfortiextenderMatch-

VendorProductVersionCPE
fortinetfortiextender_firmware*cpe:2.3:o:fortinet:fortiextender_firmware:*:*:*:*:*:*:*:*
fortinetfortiextender_firmware3.0.0cpe:2.3:o:fortinet:fortiextender_firmware:3.0.0:*:*:*:*:*:*:*
fortinetfortiextender_firmware3.0.1cpe:2.3:o:fortinet:fortiextender_firmware:3.0.1:*:*:*:*:*:*:*
fortinetfortiextender_firmware3.0.2cpe:2.3:o:fortinet:fortiextender_firmware:3.0.2:*:*:*:*:*:*:*
fortinetfortiextender_firmware3.1.0cpe:2.3:o:fortinet:fortiextender_firmware:3.1.0:*:*:*:*:*:*:*
fortinetfortiextender_firmware3.1.1cpe:2.3:o:fortinet:fortiextender_firmware:3.1.1:*:*:*:*:*:*:*
fortinetfortiextender_firmware5.3.2cpe:2.3:o:fortinet:fortiextender_firmware:5.3.2:*:*:*:*:*:*:*
fortinetfortiextender-cpe:2.3:h:fortinet:fortiextender:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiextender_firmware	*	cpe:2.3:o:fortinet:fortiextender_firmware::::::::
fortinet	fortiextender_firmware	3.0.0	cpe:2.3:o:fortinet:fortiextender_firmware:3.0.0:::::::*
fortinet	fortiextender_firmware	3.0.1	cpe:2.3:o:fortinet:fortiextender_firmware:3.0.1:::::::*
fortinet	fortiextender_firmware	3.0.2	cpe:2.3:o:fortinet:fortiextender_firmware:3.0.2:::::::*
fortinet	fortiextender_firmware	3.1.0	cpe:2.3:o:fortinet:fortiextender_firmware:3.1.0:::::::*
fortinet	fortiextender_firmware	3.1.1	cpe:2.3:o:fortinet:fortiextender_firmware:3.1.1:::::::*
fortinet	fortiextender_firmware	5.3.2	cpe:2.3:o:fortinet:fortiextender_firmware:5.3.2:::::::*
fortinet	fortiextender	-	cpe:2.3:h:fortinet:fortiextender:-:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiExtender",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "version": "5.3.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.2.0",
        "lessThanOrEqual": "4.2.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.1.1",
        "lessThanOrEqual": "4.1.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.0.0",
        "lessThanOrEqual": "4.0.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.3.0",
        "lessThanOrEqual": "3.3.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.2.1",
        "lessThanOrEqual": "3.2.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.1.0",
        "lessThanOrEqual": "3.1.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.0.0",
        "lessThanOrEqual": "3.0.2",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-048

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

Related for CVE-2022-27489