Command injection

2022-09-0907:15:00

PRIOn knowledge base

www.prio-n.com

os command injection

fortinet fortisoar

cwe-78

authenticated attacker

http get requests

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.1%

JSON

An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.

CPENameOperatorVersion
fortisoareq7.2.0
fortisoarge7.0.0
fortisoarlt7.0.3
fortisoarge6.4.1
fortisoarle6.4.4

Name	Operator	Version
fortisoar	eq	7.2.0
fortisoar	ge	7.0.0
fortisoar	lt	7.0.3
fortisoar	ge	6.4.1
fortisoar	le	6.4.4

References

fortiguard.com/psirt/FG-IR-22-156