CVE-2023-42788

Published: Oct 10, 2023Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

Affected (10)

Products: Fortinet: Fortianalyzer, Fortimanager

Fortinet

2 products

Fortianalyzer

Fortimanager

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.2.0 to 6.2.11
Fortinet Fortianalyzer	From 6.4.0 to 6.4.12
Fortinet Fortianalyzer	From 7.0.0 to 7.0.8
Fortinet Fortianalyzer	From 7.2.0 to 7.2.3
Fortinet Fortianalyzer	Version 7.4.0
Fortinet Fortimanager	From 6.2.0 to 6.2.11
Fortinet Fortimanager	From 6.4.0 to 6.4.12
Fortinet Fortimanager	From 7.0.0 to 7.0.8
Fortinet Fortimanager	From 7.2.0 to 7.2.3
Fortinet Fortimanager	Version 7.4.0