CVE-2023-48782

high

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters

References

References
More

https://www.darkreading.com/vulnerabilities-threats/fortinet-addresses-unpatched-critical-rce-vector

https://thehackernews.com/2024/12/fortinet-warns-of-critical-fortiwlm.html

https://fortiguard.com/psirt/FG-IR-23-450

Details

Source: Mitre, NVD

Published: 2023-12-13

Updated: 2023-12-15

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.0203