An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyz

Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13, Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15 and 6.2.2 through 6.2.13, Fortinet FortiAnalyzer BigData version 7.4.0, 7.2.0 through 7.2.7, 7.0.1 through 7.0.6, 6.4.5 through 6.4.7 and 6.2.5, Fortinet FortiAnalyzer Cloud version 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.13 and 6.4.1 through 6.4.7 and Fortinet FortiManager Cloud version 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.13 and 6.4.1 through 6.4.7 GUI allows an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTPS or HTTP requests.

Timeline

1. Feb 11, 2025, 4:09 PM UTCCVE published
2. Feb 11, 2025, 4:35 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 12, 2025, 3:53 PM UTCRecord last updated

Affected versions

• Fortinet FortiAnalyzer

  From 7.4.0 · through 7.4.3; From 7.2.0 · through 7.2.5; From 7.0.0 · through 7.0.13; From 6.4.0 · through 6.4.15; From 6.2.2 · through 6.2.13

• Fortinet FortiManager

  From 7.4.0 · through 7.4.3; From 7.2.0 · through 7.2.5; From 7.0.0 · through 7.0.13; From 6.4.0 · through 6.4.15; From 6.2.2 · through 6.2.13

References 1