vulnerability
Fortinet FortiManager: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2021-26104)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:L/Au:N/C:C/I:C/A:C) | Apr 6, 2022 | Jun 24, 2022 | Jun 24, 2022 |
Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
Apr 6, 2022
Added
Jun 24, 2022
Modified
Jun 24, 2022
Description
Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.
Solutions
fortinet-fortimanager-upgrade-6_0_11fortinet-fortimanager-upgrade-6_2_8fortinet-fortimanager-upgrade-6_4_6
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.