| IR Number | FG-IR-22-061 |
| Date | Jan 3, 2023 |
| Component | GUI |
| Severity |
High |
| CVSSv3 Score | 8.6 |
| Impact | Execute unauthorized code or commands |
| CVE ID | CVE-2022-39947 |
| Affected Products |
FortiADC
:
7.0.1, 7.0.0, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.6, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiADC - command injection in web interface
Summary
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.
Affected Products
FortiADC version 7.0.0 through 7.0.1
FortiADC version 6.2.0 through 6.2.3
FortiADC version 5.4.0 through 5.4.5
FortiADC all versions 6.1
FortiADC all versions 6.0
Solutions
Please upgrade to FortiADC 7.0.2 or above
Please upgrade to FortiADC 6.2.4 or above
Please upgrade to upcoming FortiADC 5.4.6 or above