7.2
High
CVE-2022-27483 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager…
Description
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiManager, FortiAnalyzer | Versions not published |
Other CVEs of Fortinet FortiManager, FortiAnalyzer
The 5 CVEs of Fortinet FortiManager, FortiAnalyzer →
CVE-2022-22300
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11,…
4.3
Medium
CVE-2021-36170
An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and…
3.2
Low
CVE-2020-12811
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow…
4.9
Medium
CVE-2017-17541
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer…
Not rated