Headline

CVE-2023-36642: Fortiguard

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

1 year ago

CVE

Open in Source

#vulnerability #auth

** PSIRT Advisories**

FortiTester - Authenticated command injection in FortiGuard explicit proxy setting

Summary

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Affected Products

FortiTester 7.2 all versions
FortiTester 7.1 all versions
FortiTester 7.0 all versions
FortiTester 4.2 all versions
FortiTester 4.1 all versions
FortiTester 4.0 all versions
FortiTester 3.9 all versions
FortiTester 3.8 all versions
FortiTester 3.7 all versions
FortiTester 3.6 all versions
FortiTester 3.5 all versions
FortiTester 3.4 all versions
FortiTester 3.3 all versions
FortiTester 3.2 all versions
FortiTester 3.1 all versions
FortiTester 3.0 all versions

Solutions

Please upgrade to FortiTester version 7.3.0 or above

Acknowledgement

Internally discovered and reported by Wilfried Djettchou of Fortinet Product Security team.

Timeline

2023-09-01: Initial publication