description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2, FortiIsolator version 2.2.0, FortiIsolator version 2.3.0 through 2.3.4 allows attacker to execute arbitrary OS commands in the underlying shell via specially crafted input parameters.
problem types: Execute unauthorized code or commands
affected:
{
vendor: Fortinet
product: FortiIsolator
defaultStatus: unaffected
versions:
versionType: semver, version: 2.3.0, lessThanOrEqual: 2.3.3, status: affected
version: 2.2.0, status: affected
versionType: semver, version: 2.1.0, lessThanOrEqual: 2.1.2, status: affected
versionType: semver, version: 2.0.0, lessThanOrEqual: 2.0.1, status: affected
versionType: semver, version: 1.2.0, lessThanOrEqual: 1.2.2, status: affected
version: 1.1.0, status: affected
version: 1.0.0, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C
]
solutions: Upgrade to FortiIsolator version 2.4.0 or above.