Command injection

2023-10-1017:15:00

PRIOn knowledge base

www.prio-n.com

command injection

os command vulnerability

fortimanager

fortianalyzer

unauthorized code execution

cli command

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

An improper neutralization of special elements used in an os command (‘OS Command Injection’) vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

CPENameOperatorVersion
fortianalyzereq7.4.0
fortianalyzerge7.2.0
fortianalyzerle7.2.3
fortianalyzerge7.0.0
fortianalyzerle7.0.8
fortianalyzerge6.4.0
fortianalyzerle6.4.12
fortianalyzerge6.2.0
fortianalyzerle6.2.11
fortimanagerge6.2.0

Name	Operator	Version
fortianalyzer	eq	7.4.0
fortianalyzer	ge	7.2.0
fortianalyzer	le	7.2.3
fortianalyzer	ge	7.0.0
fortianalyzer	le	7.0.8
fortianalyzer	ge	6.4.0
fortianalyzer	le	6.4.12
fortianalyzer	ge	6.2.0
fortianalyzer	le	6.2.11
fortimanager	ge	6.2.0