Lucene search

FortinetCVE-2021-24009

HistoryApr 06, 2022 - 10:15 a.m.

CVE-2021-24009

2022-04-0610:15:07

CWE-78

fortinet

web.nvd.nist.gov

cve-2021-24009

fortiwan

cwe-78

os command vulnerabilities

web gui

authenticated attacker

arbitrary commands

http requests

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

44.0%

JSON

Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system’s shell via specifically crafted HTTP requests.

Affected configurations

Nvd

Node

fortinetfortiwanRange≤4.5.8

VendorProductVersionCPE
fortinetfortiwan*cpe:2.3:a:fortinet:fortiwan:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiwan	*	cpe:2.3:a:fortinet:fortiwan::::::::

CNA Affected

[
  {
    "product": "Fortinet FortiWAN",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWAN before 4.5.9"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-21-060

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

44.0%

JSON

Related for CVE-2021-24009