CVE-2022-33874

published 2022-10-18

CVE-2022-33874: An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet_fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	>= 2.3.0 < 3.9.2	3.9.2
fortinet	fortitester	>= 4.0.0 < 4.2.1	4.2.1
fortinet	fortitester	>= 7.0.0 < 7.1.1	7.1.1

CWE-78