CVE-2021-36185

CWE-78 — OS Command Injection4 documents4 sources

Severity

8.8HIGH

EPSS

1.8%

top 17.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortiwlm Fortinet Fortinet Fortiwlm

Timeline

PublishedNov 2

Latest updateMay 24

Description

A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortiwlm8.2.2 — 8.6.1

▶CVEListV5fortinet/fortinet_fortiwlmFortiWLM 8.6.1, 8.6.0, 8.5.2, 8.5.1, 8.5.0, 8.4.2, 8.4.1, 8.4.0, 8.3.2, 8.3.1, 8.3.0, 8.2.2

🔴Vulnerability Details

GHSA

GHSA-m7vx-ch4r-95hf: A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8↗2022-05-24

▶

CVEList

CVE-2021-36185: A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8↗2021-11-02

▶

📋Vendor Advisories

Fortinet

A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM versio...↗2021-11-02

▶