Lucene search

PRIOn knowledge basePRION:CVE-2023-23777

HistoryJul 11, 2023 - 9:15 a.m.

Command injection

2023-07-1109:15:00

PRIOn knowledge base

www.prio-n.com

command injection

os command injection

vulnerability

fortiweb

cwe-78

privileged attacker

arbitrary bash commands

crafted cli backup parameters

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.8%

JSON

An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters.

CPENameOperatorVersion
fortiwebeq7.0.0
fortiwebeq7.0.1
fortiwebge6.3.6
fortiweble6.3.18
fortiwebge6.4.0
fortiweble6.4.3

Name	Operator	Version
fortiweb	eq	7.0.0
fortiweb	eq	7.0.1
fortiweb	ge	6.3.6
fortiweb	le	6.3.18
fortiweb	ge	6.4.0
fortiweb	le	6.4.3

References

fortiguard.com/psirt/FG-IR-22-131