FortiSOAR - OS Command Injection in Agent Password Field

2022-09-0600:00:00

FortiGuard Labs

www.fortiguard.com

fortisoar

command injection

cwe-78

http

authentication

vulnerability

0.001 Low

EPSS

Percentile

51.1%

JSON

An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSOAR may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.

CPENameOperatorVersion
fortisoareq7.2.0
fortisoareq7.0.2
fortisoareq7.0.1
fortisoareq7.0.0
fortisoareq6.4.4
fortisoareq6.4.3
fortisoareq6.4.1

Name	Operator	Version
fortisoar	eq	7.2.0
fortisoar	eq	7.0.2
fortisoar	eq	7.0.1
fortisoar	eq	7.0.0
fortisoar	eq	6.4.4
fortisoar	eq	6.4.3
fortisoar	eq	6.4.1

0.001 Low

EPSS

Percentile

51.1%

JSON

Related for FG-IR-22-156