by Kastro
Paper/Archive/CVE-2022-33873

CVE-2022-33873

Fortinet Fortinet FortiTester — An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login c…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.7.857 × 2017.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the underlying shell.

Affected

ProductAffectedFixed inSource
Fortinet FortiTesterFortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)6.8CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-22-237