Overview
- Description
- A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.
- Source
- psirt@fortinet.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Weaknesses
- psirt@fortinet.com
- CWE-78
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortiddos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31921E5A-497A-4BD6-9BE8-2307272F3FEC",
"versionEndExcluding": "5.6.2",
"versionStartIncluding": "4.5.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiddos:5.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "258903F9-C0F0-40CD-8895-43FF00C71709"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiddos-f:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "561DFFB8-E39C-40D1-A7E7-255BDD6F9F73"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiddos-f:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "777DD368-CD36-4842-BA0F-C7C64E7D2A78",
"versionEndExcluding": "6.4.2",
"versionStartIncluding": "6.1.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiddos-f:6.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DB1731B-7799-408B-8F8C-F5ABFEA7A180"
}
],
"operator": "OR"
}
]
}
]