Описание
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as root via execute CLI commands.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
6.6 Medium
CVSS3
7.8 High
CVSS3
Дефекты
Связанные уязвимости
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.
Уязвимость интерфейса командной строки (CLI) программно-аппаратных средств защиты от DDoS-атак FortiDDoS и FortiDDoS-F, позволяющая нарушителю выполнить произвольные команды
EPSS
6.6 Medium
CVSS3
7.8 High
CVSS3