CVE-2022-27483 — OS Command Injection in Fortinet Fortianalyzer

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.2HIGHNVD
EPSS
5.4%
top 9.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortianalyzerFortinet Fortimanager
Timeline
PublishedJul 19
Latest updateJul 20

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortimanager6.0.0 — 6.0.11+3
▶NVDfortinet/fortianalyzer6.0.0 — 6.0.11+3

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7ghq-6v49-v396: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7↗2022-07-20
▶
CVEList
CVE-2022-27483: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7↗2022-07-18
▶

📋Vendor Advisories

1
Fortinet
OS command injection vulnerability in CLI↗2022-07-19
▶
CVE-2022-27483 — OS Command Injection in Fortinet | cvebase