CyberCVE

CVE-2024-23109

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API re

Severity
Critical 9.7
CVSS 3.1
Exploited
Not listed
EPSS
0.032
87.0th percentile
Discovered by
Not disclosed
Published
Feb 5, 2024
Assigned by fortinet

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiSIEM SIEM & Log Management cna-assigner
Vendor-reported affected versions (6)
  • Fortinet · FortiSIEM
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem
  • fortinet · fortisiem

Vendor remediation

Please upgrade to FortiSIEM version 7.1.2 or above Please upgrade to FortiSIEM version 7.0.3 or above Please upgrade to FortiSIEM version 6.7.9 or above Please upgrade to FortiSIEM version 6.6.4 or above Please upgrade to FortiSIEM version 6.5.3 or above Please upgrade to FortiSIEM version 6.4.4 or above Please upgrade to upcoming FortiSIEM version 7.2.0 or above

References