Paper/Archive/CVE-2024-23109

CVE-2024-23109

Fortinet FortiSIEM — An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker…

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.5.885 × 2017.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Affected

ProductAffectedFixed inSource

FortiSIEM7.1.1–CNA

FortiSIEM7.0.0 – 7.0.2–CNA

FortiSIEM6.7.0 – 6.7.8–CNA

FortiSIEM6.6.0 – 6.6.3–CNA

FortiSIEM6.5.0 – 6.5.2–CNA

FortiSIEM6.4.0 – 6.4.3–CNA

fortisiem7.1.1–CISA-ADP

fortisiem7.0.0 – 7.0.2–CISA-ADP

fortisiem6.7.0 – 6.7.8–CISA-ADP

fortisiem6.6.0 – 6.6.3–CISA-ADP

fortisiem6.5.0 – 6.5.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-130