by Kastro
Paper/Archive/CVE-2024-23108

CVE-2024-23108

Fortinet FortiSIEM — An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker…

EPSS 80%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.6.996 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Affected

ProductAffectedFixed inSource
FortiSIEM7.1.0 – 7.1.1–CNA
FortiSIEM7.0.0 – 7.0.2–CNA
FortiSIEM6.7.0 – 6.7.8–CNA
FortiSIEM6.6.0 – 6.6.3–CNA
FortiSIEM6.5.0 – 6.5.2–CNA
FortiSIEM6.4.0 – 6.4.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-130exploitgithub.com/horizon3ai/CVE-2024-23108