Description
An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.
Published: 2023-02-16
Score: 8.6 High
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Please upgrade to FortiWeb version 7.0.2 or above Please upgrade to FortiWeb version 6.3.20 or above

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-52254 An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.
References
Link Providers
https://fortiguard.com/psirt/FG-IR-22-163 cve-icon cve-icon
History

Wed, 23 Oct 2024 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Fortinet Fortiweb
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2024-10-23T14:50:25.965Z

Reserved: 2022-05-06T12:09:27.623Z

Link: CVE-2022-30303

cve-icon Vulnrichment

Updated: 2024-08-03T06:48:35.825Z

cve-icon NVD

Status : Modified

Published: 2023-02-16T19:15:12.467

Modified: 2024-11-21T07:02:32.090

Link: CVE-2022-30303

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses