OS command injection vulnerability in CLI Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-049 Final 1 1 2022-07-05T00:00:00 Current version 2022-07-05T00:00:00 2022-07-05T00:00:00 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiAnalyzer & FortiManager may allow an authenticated attacker to execute arbitrary shell code as root user via diagnose system CLI commands. None Execute unauthorized code or commands At leastFortiManager 7.2 all versions are not affectedFortiManager version 7.0.0 through 7.0.3FortiManager version 6.4.0 through 6.4.7FortiManager 6.2 all versionsFortiManager 6.0 all versionsAt leastFortiAnalyzer 7.2 all versions are not affectedFortiAnalyzer version 7.0.0 through 7.0.3FortiAnalyzer version 6.4.0 through 6.4.7FortiAnalyzer 6.2 all versionsFortiAnalyzer 6.0 all versions Upgrade to FortiAnalyzer version 7.2.0 or above,Upgrade to FortiAnalyzer version 7.0.4 or above,Upgrade to FortiAnalyzer version 6.4.8 or above.Upgrade to FortiManager version 7.2.0 or above,Upgrade to FortiManager version 7.0.4 or above,Upgrade to FortiManager version 6.4.8 or above. Internally discovered and reported by Théo Leleu of Fortinet Product Security team. FortiAnalyzer 7.0.3 FortiAnalyzer 7.0.2 FortiAnalyzer 7.0.1 FortiAnalyzer 7.0.0 FortiAnalyzer 6.4.7 FortiAnalyzer 6.4.6 FortiAnalyzer 6.4.5 FortiAnalyzer 6.4.4 FortiAnalyzer 6.4.3 FortiAnalyzer 6.4.2 FortiAnalyzer 6.4.1 FortiAnalyzer 6.4.0 FortiAnalyzer 6.2.13 FortiAnalyzer 6.2.12 FortiAnalyzer 6.2.11 FortiAnalyzer 6.2.10 FortiAnalyzer 6.2.9 FortiAnalyzer 6.2.8 FortiAnalyzer 6.2.7 FortiAnalyzer 6.2.6 FortiAnalyzer 6.2.5 FortiAnalyzer 6.2.4 FortiAnalyzer 6.2.3 FortiAnalyzer 6.2.2 FortiAnalyzer 6.2.1 FortiAnalyzer 6.2.0 FortiAnalyzer 6.0.12 FortiAnalyzer 6.0.11 FortiAnalyzer 6.0.10 FortiAnalyzer 6.0.9 FortiAnalyzer 6.0.8 FortiAnalyzer 6.0.7 FortiAnalyzer 6.0.6 FortiAnalyzer 6.0.5 FortiAnalyzer 6.0.4 FortiAnalyzer 6.0.3 FortiAnalyzer 6.0.2 FortiAnalyzer 6.0.1 FortiAnalyzer 6.0.0 FortiManager 7.0.3 FortiManager 7.0.2 FortiManager 7.0.1 FortiManager 7.0.0 FortiManager 6.4.7 FortiManager 6.4.6 FortiManager 6.4.5 FortiManager 6.4.4 FortiManager 6.4.3 FortiManager 6.4.2 FortiManager 6.4.1 FortiManager 6.4.0 FortiManager 6.2.13 FortiManager 6.2.12 FortiManager 6.2.11 FortiManager 6.2.10 FortiManager 6.2.9 FortiManager 6.2.8 FortiManager 6.2.7 FortiManager 6.2.6 FortiManager 6.2.5 FortiManager 6.2.4 FortiManager 6.2.3 FortiManager 6.2.2 FortiManager 6.2.1 FortiManager 6.2.0 FortiManager 6.0.12 FortiManager 6.0.11 FortiManager 6.0.10 FortiManager 6.0.9 FortiManager 6.0.8 FortiManager 6.0.7 FortiManager 6.0.6 FortiManager 6.0.5 FortiManager 6.0.4 FortiManager 6.0.3 FortiManager 6.0.2 FortiManager 6.0.1 FortiManager 6.0.0 CVE-2022-27483 FortiAnalyzer-7.0.3 FortiAnalyzer-7.0.2 FortiAnalyzer-7.0.1 FortiAnalyzer-7.0.0 FortiAnalyzer-6.4.7 FortiAnalyzer-6.4.6 FortiAnalyzer-6.4.5 FortiAnalyzer-6.4.4 FortiAnalyzer-6.4.3 FortiAnalyzer-6.4.2 FortiAnalyzer-6.4.1 FortiAnalyzer-6.4.0 FortiAnalyzer-6.2.13 FortiAnalyzer-6.2.12 FortiAnalyzer-6.2.11 FortiAnalyzer-6.2.10 FortiAnalyzer-6.2.9 FortiAnalyzer-6.2.8 FortiAnalyzer-6.2.7 FortiAnalyzer-6.2.6 FortiAnalyzer-6.2.5 FortiAnalyzer-6.2.4 FortiAnalyzer-6.2.3 FortiAnalyzer-6.2.2 FortiAnalyzer-6.2.1 FortiAnalyzer-6.2.0 FortiAnalyzer-6.0.12 FortiAnalyzer-6.0.11 FortiAnalyzer-6.0.10 FortiAnalyzer-6.0.9 FortiAnalyzer-6.0.8 FortiAnalyzer-6.0.7 FortiAnalyzer-6.0.6 FortiAnalyzer-6.0.5 FortiAnalyzer-6.0.4 FortiAnalyzer-6.0.3 FortiAnalyzer-6.0.2 FortiAnalyzer-6.0.1 FortiAnalyzer-6.0.0 FortiManager-7.0.3 FortiManager-7.0.2 FortiManager-7.0.1 FortiManager-7.0.0 FortiManager-6.4.7 FortiManager-6.4.6 FortiManager-6.4.5 FortiManager-6.4.4 FortiManager-6.4.3 FortiManager-6.4.2 FortiManager-6.4.1 FortiManager-6.4.0 FortiManager-6.2.13 FortiManager-6.2.12 FortiManager-6.2.11 FortiManager-6.2.10 FortiManager-6.2.9 FortiManager-6.2.8 FortiManager-6.2.7 FortiManager-6.2.6 FortiManager-6.2.5 FortiManager-6.2.4 FortiManager-6.2.3 FortiManager-6.2.2 FortiManager-6.2.1 FortiManager-6.2.0 FortiManager-6.0.12 FortiManager-6.0.11 FortiManager-6.0.10 FortiManager-6.0.9 FortiManager-6.0.8 FortiManager-6.0.7 FortiManager-6.0.6 FortiManager-6.0.5 FortiManager-6.0.4 FortiManager-6.0.3 FortiManager-6.0.2 FortiManager-6.0.1 FortiManager-6.0.0 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-22-049 OS command injection vulnerability in CLI Reference>