Fortinet FortiWeb OS Command Injection Vulnerability Allowing Unauthorized Code Execution

A command injection vulnerability has been identified in Fortinet FortiWeb versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and prior to 7.0.10. This vulnerability allows an authenticated privileged attacker to execute unauthorized code or commands by crafting specific CLI commands. The issue arises from improper neutralization of special elements used in operating system commands, creating an OS command injection vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the affected system.

Remediation

Users can upgrade to Fortinet FortiWeb 7.6.4 or above, 7.4.8 or above, 7.2.11 or above, or 7.0.11 or above, depending on their current version.