Lucene search

[email protected]NVD:CVE-2022-33874

HistoryOct 18, 2022 - 3:15 p.m.

CVE-2022-33874

2022-10-1815:15:09

CWE-78

[email protected]

web.nvd.nist.gov

cve-2022-33874

os command injection

fortitester

ssh login

cwe-78

remote attacker

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%

JSON

An improper neutralization of special elements used in an OS Command (‘OS Command Injection’) vulnerabilities [CWE-78] in SSH login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.

Affected configurations

Nvd

Node

fortinetfortitesterRange2.3.0–3.9.2

fortinetfortitesterRange4.0.0–4.2.1

fortinetfortitesterRange7.0.0–7.1.1

VendorProductVersionCPE
fortinetfortitester*cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortitester	*	cpe:2.3:a:fortinet:fortitester::::::::

References

fortiguard.com/psirt/FG-IR-22-237

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%

JSON

Related for NVD:CVE-2022-33874

prion1 cve1 cvelist1