CVE-2023-34992

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.0.0 and 6.7.0 through 6.7.5 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via crafted API requests.

References

https://www.bleepingcomputer.com/news/security/new-fortinet-rce-bug-is-actively-exploited-cisa-confirms/?&web_view=true

https://www.bleepingcomputer.com/news/security/new-fortinet-rce-bug-is-actively-exploited-cisa-confirms/

https://www.theregister.com/2024/02/09/a_look_at_fortinet_week/

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-fortisiem-rce-bugs-in-confusing-disclosure/

https://securityaffairs.com/158813/security/fortinet-addressed-two-critical-fortisiem-vulnerabilities.html

https://thecyberthrone.in/2024/02/07/fortinet-fixes-critical-vulnerabilities-in-fortisiem/

https://www.bleepingcomputer.com/news/security/fortinet-snafu-critical-fortisiem-cves-are-duplicates-issued-in-error/

https://www.theregister.com/2024/02/06/fortinet_fortisiem_vulns/

https://fortiguard.com/psirt/FG-IR-23-130

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3