Command injection due to an unsafe usage of function
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-22-352
Final
1
1
2023-10-10T00:00:00
Current version
2023-10-10T00:00:00
2023-10-10T00:00:00
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager, FortiAnalyzer and FortiADC management interface may allow an authenticated attacker with at least READ permissions on system settings to execute arbitrary commands on the underlying shell due to an unsafe usage of the wordexp function.
None
Execute unauthorized code or commands
Internally discovered and reported by Wilfried Djettchou of Fortinet Product Security team.
FortiADC 7.1.0
FortiADC 7.0.3
FortiADC 7.0.2
FortiADC 7.0.1
FortiADC 7.0.0
FortiADC 6.2.6
FortiADC 6.2.5
FortiADC 6.2.4
FortiADC 6.2.3
FortiADC 6.2.2
FortiADC 6.2.1
FortiADC 6.2.0
FortiADC 6.1.6
FortiADC 6.1.5
FortiADC 6.1.4
FortiADC 6.1.3
FortiADC 6.1.2
FortiADC 6.1.1
FortiADC 6.1.0
FortiADC 6.0.4
FortiADC 6.0.3
FortiADC 6.0.2
FortiADC 6.0.1
FortiADC 6.0.0
FortiAnalyzer 7.2.2
FortiAnalyzer 7.2.1
FortiAnalyzer 7.2.0
FortiAnalyzer 7.0.7
FortiAnalyzer 7.0.6
FortiAnalyzer 7.0.5
FortiAnalyzer 7.0.4
FortiAnalyzer 7.0.3
FortiAnalyzer 7.0.2
FortiAnalyzer 7.0.1
FortiAnalyzer 7.0.0
FortiAnalyzer 6.4.11
FortiAnalyzer 6.4.10
FortiAnalyzer 6.4.9
FortiAnalyzer 6.4.8
FortiAnalyzer 6.4.7
FortiAnalyzer 6.4.6
FortiAnalyzer 6.4.5
FortiAnalyzer 6.4.4
FortiAnalyzer 6.4.3
FortiAnalyzer 6.4.2
FortiAnalyzer 6.4.1
FortiAnalyzer 6.4.0
FortiAnalyzer 6.2.13
FortiAnalyzer 6.2.12
FortiAnalyzer 6.2.11
FortiAnalyzer 6.2.10
FortiAnalyzer 6.2.9
FortiAnalyzer 6.2.8
FortiAnalyzer 6.2.7
FortiAnalyzer 6.2.6
FortiAnalyzer 6.2.5
FortiAnalyzer 6.2.4
FortiAnalyzer 6.2.3
FortiAnalyzer 6.2.2
FortiAnalyzer 6.2.1
FortiAnalyzer 6.2.0
FortiAnalyzer 6.0.12
FortiAnalyzer 6.0.11
FortiAnalyzer 6.0.10
FortiAnalyzer 6.0.9
FortiAnalyzer 6.0.8
FortiAnalyzer 6.0.7
FortiAnalyzer 6.0.6
FortiAnalyzer 6.0.5
FortiAnalyzer 6.0.4
FortiAnalyzer 6.0.3
FortiAnalyzer 6.0.2
FortiAnalyzer 6.0.1
FortiAnalyzer 6.0.0
FortiManager 7.2.2
FortiManager 7.2.1
FortiManager 7.2.0
FortiManager 7.0.7
FortiManager 7.0.6
FortiManager 7.0.5
FortiManager 7.0.4
FortiManager 7.0.3
FortiManager 7.0.2
FortiManager 7.0.1
FortiManager 7.0.0
FortiManager 6.4.11
FortiManager 6.4.10
FortiManager 6.4.9
FortiManager 6.4.8
FortiManager 6.4.7
FortiManager 6.4.6
FortiManager 6.4.5
FortiManager 6.4.4
FortiManager 6.4.3
FortiManager 6.4.2
FortiManager 6.4.1
FortiManager 6.4.0
FortiManager 6.2.13
FortiManager 6.2.12
FortiManager 6.2.11
FortiManager 6.2.10
FortiManager 6.2.9
FortiManager 6.2.8
FortiManager 6.2.7
FortiManager 6.2.6
FortiManager 6.2.5
FortiManager 6.2.4
FortiManager 6.2.3
FortiManager 6.2.2
FortiManager 6.2.1
FortiManager 6.2.0
FortiManager 6.0.12
FortiManager 6.0.11
FortiManager 6.0.10
FortiManager 6.0.9
FortiManager 6.0.8
FortiManager 6.0.7
FortiManager 6.0.6
FortiManager 6.0.5
FortiManager 6.0.4
FortiManager 6.0.3
FortiManager 6.0.2
FortiManager 6.0.1
FortiManager 6.0.0
Command injection due to an unsafe usage of function
CVE-2023-25607
FortiADC-7.1.0
FortiADC-7.0.3
FortiADC-7.0.2
FortiADC-7.0.1
FortiADC-7.0.0
FortiADC-6.2.6
FortiADC-6.2.5
FortiADC-6.2.4
FortiADC-6.2.3
FortiADC-6.2.2
FortiADC-6.2.1
FortiADC-6.2.0
FortiADC-6.1.6
FortiADC-6.1.5
FortiADC-6.1.4
FortiADC-6.1.3
FortiADC-6.1.2
FortiADC-6.1.1
FortiADC-6.1.0
FortiADC-6.0.4
FortiADC-6.0.3
FortiADC-6.0.2
FortiADC-6.0.1
FortiADC-6.0.0
FortiAnalyzer-7.2.2
FortiAnalyzer-7.2.1
FortiAnalyzer-7.2.0
FortiAnalyzer-7.0.7
FortiAnalyzer-7.0.6
FortiAnalyzer-7.0.5
FortiAnalyzer-7.0.4
FortiAnalyzer-7.0.3
FortiAnalyzer-7.0.2
FortiAnalyzer-7.0.1
FortiAnalyzer-7.0.0
FortiAnalyzer-6.4.11
FortiAnalyzer-6.4.10
FortiAnalyzer-6.4.9
FortiAnalyzer-6.4.8
FortiAnalyzer-6.4.7
FortiAnalyzer-6.4.6
FortiAnalyzer-6.4.5
FortiAnalyzer-6.4.4
FortiAnalyzer-6.4.3
FortiAnalyzer-6.4.2
FortiAnalyzer-6.4.1
FortiAnalyzer-6.4.0
FortiAnalyzer-6.2.13
FortiAnalyzer-6.2.12
FortiAnalyzer-6.2.11
FortiAnalyzer-6.2.10
FortiAnalyzer-6.2.9
FortiAnalyzer-6.2.8
FortiAnalyzer-6.2.7
FortiAnalyzer-6.2.6
FortiAnalyzer-6.2.5
FortiAnalyzer-6.2.4
FortiAnalyzer-6.2.3
FortiAnalyzer-6.2.2
FortiAnalyzer-6.2.1
FortiAnalyzer-6.2.0
FortiAnalyzer-6.0.12
FortiAnalyzer-6.0.11
FortiAnalyzer-6.0.10
FortiAnalyzer-6.0.9
FortiAnalyzer-6.0.8
FortiAnalyzer-6.0.7
FortiAnalyzer-6.0.6
FortiAnalyzer-6.0.5
FortiAnalyzer-6.0.4
FortiAnalyzer-6.0.3
FortiAnalyzer-6.0.2
FortiAnalyzer-6.0.1
FortiAnalyzer-6.0.0
FortiManager-7.2.2
FortiManager-7.2.1
FortiManager-7.2.0
FortiManager-7.0.7
FortiManager-7.0.6
FortiManager-7.0.5
FortiManager-7.0.4
FortiManager-7.0.3
FortiManager-7.0.2
FortiManager-7.0.1
FortiManager-7.0.0
FortiManager-6.4.11
FortiManager-6.4.10
FortiManager-6.4.9
FortiManager-6.4.8
FortiManager-6.4.7
FortiManager-6.4.6
FortiManager-6.4.5
FortiManager-6.4.4
FortiManager-6.4.3
FortiManager-6.4.2
FortiManager-6.4.1
FortiManager-6.4.0
FortiManager-6.2.13
FortiManager-6.2.12
FortiManager-6.2.11
FortiManager-6.2.10
FortiManager-6.2.9
FortiManager-6.2.8
FortiManager-6.2.7
FortiManager-6.2.6
FortiManager-6.2.5
FortiManager-6.2.4
FortiManager-6.2.3
FortiManager-6.2.2
FortiManager-6.2.1
FortiManager-6.2.0
FortiManager-6.0.12
FortiManager-6.0.11
FortiManager-6.0.10
FortiManager-6.0.9
FortiManager-6.0.8
FortiManager-6.0.7
FortiManager-6.0.6
FortiManager-6.0.5
FortiManager-6.0.4
FortiManager-6.0.3
FortiManager-6.0.2
FortiManager-6.0.1
FortiManager-6.0.0
7.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
https://fortiguard.fortinet.com/psirt/FG-IR-22-352
Command injection due to an unsafe usage of function
Reference>