Command Injection Vulnerabilities in FortiWeb by Fortinet
CVE-2021-36195

4.2MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Fortiweb
Vendor
CVE Published:
8 December 2021

Summary

FortiWeb, a web application firewall from Fortinet, contains multiple command injection vulnerabilities within its command line interpreter. These vulnerabilities can be exploited by an authenticated attacker with crafted command arguments, enabling arbitrary command execution on the underlying system shell. This could potentially lead to unauthorized actions and compromise the integrity of the affected system. It's essential for users to apply the latest updates to mitigate this risk and ensure the ongoing security of their web applications.

Affected Version(s)

Fortinet FortiWeb FortiWeb 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2

References

https://fortiguard.com/advisory/FG-IR-21-157
x_refsource_CONFIRM

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.