CVE-2024-21760
An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all ver
Severity
High 7.7
CVSS 3.1
Exploited
Not listed
EPSS
0.008
55.5th percentile
Discovered by
Third party
Vendor advisory field
Published
Mar 18, 2025
Assigned by fortinet
Description
An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker to execute arbitrary code on the host via a playbook code snippet.
Weakness: CWE-94
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSOAR | SIEM & Log Management | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiSOAR
Credit
Fortinet is pleased to thank Bilal Alqurneh for reporting this vulnerability under responsible disclosure
Vendor remediation
Please upgrade to FortiSOAR version 7.5.0 or above