Command injection

2023-02-1619:15:00

PRIOn knowledge base

www.prio-n.com

command injection

fortinet fortiextender

http requests

unauthorized code execution

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.5%

JSON

A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

CPENameOperatorVersion
fortiextender_firmwarege3.2.1
fortiextender_firmwarelt3.2.4
fortiextender_firmwarege3.3.0
fortiextender_firmwarelt3.3.3
fortiextender_firmwarege4.1.1
fortiextender_firmwarelt4.1.9
fortiextender_firmwarege4.2.0
fortiextender_firmwarelt4.2.5
fortiextender_firmwarege7.0.0
fortiextender_firmwarelt7.0.4

Name	Operator	Version
fortiextender_firmware	ge	3.2.1
fortiextender_firmware	lt	3.2.4
fortiextender_firmware	ge	3.3.0
fortiextender_firmware	lt	3.3.3
fortiextender_firmware	ge	4.1.1
fortiextender_firmware	lt	4.1.9
fortiextender_firmware	ge	4.2.0
fortiextender_firmware	lt	4.2.5
fortiextender_firmware	ge	7.0.0
fortiextender_firmware	lt	7.0.4

Rows per page:

1-10 of 161

References

fortiguard.com/psirt/FG-IR-22-048