description: Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments.
problem types: Execute unauthorized code or commands
affected:
{
product: Fortinet FortiWeb
vendor: Fortinet
versions:
status: affected, version: FortiWeb 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: HIGH
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
version: 3.1
]