| IR Number | FG-IR-21-166 |
| Date | Feb 1, 2022 |
| Component | GUI |
| Severity |
High |
| CVSSv3 Score | 8.3 |
| Impact | Execute unauthorized code or commands |
| CVE ID | CVE-2021-41018 |
| Affected Products |
FortiWeb
:
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
|
| CVRF | Download |
| Language |
Refine Search
PSIRT Advisories
FortiWeb - OS command injection due to unsafe input validation function
Summary
An improper neutralization of special elements used in an OS command vulnerability ('OS Command Injection') [CWE-78] in FortiWeb may allow authenticated users to execute unauthorized code or commands via crafted HTTP GET requests to WAD configuration handlers.
Affected Products
FortiWeb version 6.4.1 and below
FortiWeb version 6.3.15 and below
FortiWeb version 6.2.6 and below
Solutions
Upgrade to the upcoming FortiWeb version 7.0.0 or above
Upgrade to FortiWeb version 6.4.2Â or above
Upgrade to FortiWeb version 6.3.16Â or above
Upgrade to FortiWeb version 6.2.7 or above