vulnerability
Fortinet FortiAnalyzer: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2021-26104)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:L/Au:N/C:C/I:C/A:C) | Apr 6, 2022 | Apr 18, 2022 | Apr 25, 2022 |
Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
Apr 6, 2022
Added
Apr 18, 2022
Modified
Apr 25, 2022
Description
Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.
Solutions
fortinet-fortianalyzer-upgrade-6_0_11fortinet-fortianalyzer-upgrade-6_2_8fortinet-fortianalyzer-upgrade-6_4_6
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.