CVE-2021-36180

CWE-78 — OS Command Injection CWE-77 — Command Injection4 documents4 sources

Severity

8.8HIGH

EPSS

0.5%

top 34.42%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortiweb Fortinet Fortinet Fortiweb

Timeline

PublishedDec 8

Latest updateDec 9

Description

Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDfortinet/fortiweb5.8.0 — 5.8.6+9

▶CVEListV5fortinet/fortinet_fortiwebFortiWeb 6.4.1 and below, 6.3.15 and below, 6.2.5 and below

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

GHSA

GHSA-c439-xxv3-pcx2: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6↗2021-12-09

▶

CVEList

CVE-2021-36180: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6↗2021-12-08

▶

📋Vendor Advisories

Fortinet

Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management i...↗2021-12-08

▶