5.9
Medium
CVE-2022-27486 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS…
Description
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiDDoS | 5.7.0 | No fix stated |
| FortiDDoS 5.5 | 5.5.0 → 5.5.1 | No fix stated |
| FortiDDoS 5.4 | 5.4.0 → 5.4.2 | No fix stated |
| FortiDDoS 5.3 | 5.3.0 → 5.3.2 | No fix stated |
| FortiDDoS | 5.2.0 | No fix stated |
| FortiDDoS | 5.1.0 | No fix stated |
| FortiDDoS | 5.0.0 | No fix stated |
| FortiDDoS | 4.7.0 | No fix stated |
| FortiDDoS | 4.6.0 | No fix stated |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiDDoS | 4.5.0 | No fix stated |
| FortiDDoS-F | 6.5.0 | No fix stated |
| FortiDDoS-F 6.4 | 6.4.0 → 6.4.1 | No fix stated |
| FortiDDoS-F 6.3 | 6.3.0 → 6.3.4 | No fix stated |
| FortiDDoS-F 6.2 | 6.2.0 → 6.2.2 | No fix stated |
| FortiDDoS-F 6.1 | 6.1.0 → 6.1.5 | No fix stated |
Other CVEs of FortiDDoS
The 6 CVEs of FortiDDoS →
CVE-2021-24008
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS…
5.0
Medium
CVE-2022-23439
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison…
4.1
Medium
CVE-2022-40679
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all…
7.1
High
CVE-2021-36193
Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an…
6.3
Medium