Description
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup .
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
E
F
RL
X
RC
Changed
Affected products
- fortinet / fortitester7.2.0 – 7.2.3
- fortinet / fortitester7.1.0 – 7.1.1
- fortinet / fortitester7.0.0 – 7.0.0
- fortinet / fortitester4.2.0 – 4.2.1
- fortinet / fortitester4.1.0 – 4.1.1
- fortinet / fortitester4.0.0 – 4.0.0
- fortinet / fortitester3.9.0 – 3.9.2
- fortinet / fortitester3.8.0 – 3.8.0
- fortinet / fortitester3.7.0 – 3.7.1
- fortinet / fortitester3.6.0 – 3.6.0
- fortinet / fortitester3.5.0 – 3.5.1
- fortinet / fortitester3.4.0 – 3.4.0
- fortinet / fortitester3.3.0 – 3.3.1
- fortinet / fortitester3.2.0 – 3.2.0
- fortinet / fortitester3.1.0 – 3.1.0
- fortinet / fortitester3.0.0 – 3.0.0
- fortinet / fortitester2.9.0 – 2.9.0
- fortinet / fortitester2.8.0 – 2.8.0
- fortinet / fortitester2.7.0 – 2.7.0
- fortinet / fortitester2.6.0 – 2.6.0
- fortinet / fortitester2.5.0 – 2.5.0
- fortinet / fortitester2.4.0 – 2.4.1
- fortinet / fortitester2.3.0 – 2.3.0
References
- VENDOR_ADVISORYhttps://fortiguard.com/psirt/FG-IR-22-345