CVE-2022-33870

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.8HIGH
EPSS
0.3%
top 48.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet Fortinet FortitesterFortinet Fortitester
Timeline
PublishedNov 2

Description

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortitester20 versions+19
▶CVEListV5fortinet/fortinet_fortitesterFortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xcwx-v6r5-6jgq: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3↗2022-11-02
▶
CVEList
CVE-2022-33870: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3↗2022-11-02
▶

📋Vendor Advisories

1
Fortinet
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpre...↗2022-11-02
▶
CVE-2022-33870 (HIGH CVSS 7.8) | An improper neutralization of speci | cvebase.io