FortiSOAR - Server-side Template Injection in playbook execution

2023-04-1100:00:00

FortiGuard Labs

www.fortiguard.com

fortisoar

template injection

cwe-1336

vulnerability

remote attacker

authenticated

arbitrary code

crafted payload

management interface

0.002 Low

EPSS

Percentile

55.6%

JSON

An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload.

CPENameOperatorVersion
fortisoareq7.3.1
fortisoareq7.3.0

CPE	Name	Operator	Version
	fortisoar	eq	7.3.1
	fortisoar	eq	7.3.0

0.002 Low

EPSS

Percentile

55.6%

JSON

Related for FG-IR-23-051