CVE-2023-33300

CWE-77 — Command Injection4 documents4 sources
Severity
5.3MEDIUM
EPSS
3.9%
top 11.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortinac
Timeline
PublishedMar 14

Description

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDfortinet/fortinac7.2.0 — 7.2.2+1
▶CVEListV5fortinet/fortinac9.4.0 — 9.4.3+1

🔴Vulnerability Details

2
GHSA
GHSA-5jp2-5x2p-j8xr: A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7↗2025-03-14
▶
CVEList
CVE-2023-33300: A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7↗2025-03-14
▶

📋Vendor Advisories

1
Fortinet
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and ear...↗2025-03-14
▶
CVE-2023-33300 (MEDIUM CVSS 5.3) | A improper neutralization of specia | cvebase.io