CVE-2021-36180
published 2021-12-08CVE-2021-36180: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and…
PriorityP354high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.07%
61.0th percentile
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet_fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | — | — |
| fortinet | fortiweb | 5.8.0 – 5.8.6 | — |
| fortinet | fortiweb | 6.0.0 – 6.0.7 | — |
| fortinet | fortiweb | 6.2.0 – 6.2.5 | — |
| fortinet | fortiweb | 6.3.0 – 6.3.15 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management i...
vendor_fortinet·2021-12-08·CVSS 8.1
CVE-2021-36180 [HIGH] CWE-78 Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management i...
FG-IR-21-120: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management i...
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
CVEs: CVE-2021-36180
CWEs: CWE-78
CVSS: 8.1 (high)
Affected products: FortiWeb
GHSA
GHSA-c439-xxv3-pcx2: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6
ghsa_unreviewed·2021-12-09
CVE-2021-36180 [HIGH] CWE-77 GHSA-c439-xxv3-pcx2: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-12-08
Published