Lucene search

FortinetCVE-2019-15710

HistoryOct 31, 2019 - 8:15 p.m.

CVE-2019-15710

2019-10-3120:15:11

CWE-78

fortinet

web.nvd.nist.gov

cve-2019-15710

fortiextender

os command injection

vulnerability

nvd

cli admin console

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted “execute date” commands.

Affected configurations

Nvd

Node

fortiguardfortiextender_firmwareRange≤4.1.1

AND

fortiguardfortiextenderMatch-

VendorProductVersionCPE
fortiguardfortiextender_firmware*cpe:2.3:o:fortiguard:fortiextender_firmware:*:*:*:*:*:*:*:*
fortiguardfortiextender-cpe:2.3:h:fortiguard:fortiextender:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortiguard	fortiextender_firmware	*	cpe:2.3:o:fortiguard:fortiextender_firmware::::::::
fortiguard	fortiextender	-	cpe:2.3:h:fortiguard:fortiextender:-:::::::*

CNA Affected

[
  {
    "product": "FortiExtender",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.0 to 4.1.1"
      },
      {
        "status": "affected",
        "version": "4.0.0 and below"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-19-273

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

Related for CVE-2019-15710