CyberCVE

CVE-2024-23109

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API re

Severity
Critical 9.7
CVSS 3.1
Exploited
Not listed
EPSS
0.032
87.7th percentile
Discovered by
Third party
Vendor advisory field
Published
Feb 5, 2024
Assigned by fortinet

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiSIEM SIEM & Log Management cna-assigner
Vendor-reported products (6)
  • Fortinet · FortiSIEM
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem

Credit

Fortinet is pleased to thank security researchers Zach Hanley (@hacks_zach) of Horizon3.ai for discovering and reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiSIEM version 7.1.2 or above Please upgrade to FortiSIEM version 7.0.3 or above Please upgrade to FortiSIEM version 6.7.9 or above Please upgrade to FortiSIEM version 6.6.4 or above Please upgrade to FortiSIEM version 6.5.3 or above Please upgrade to FortiSIEM version 6.4.4 or above Please upgrade to upcoming FortiSIEM version 7.2.0 or above

References

Something wrong here?