An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.
References
| Link | Resource |
|---|---|
| https://fortiguard.com/psirt/FG-IR-22-163 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:47
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests. |
24 Feb 2023, 23:34
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| References | (MISC) https://fortiguard.com/psirt/FG-IR-22-163 - Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Fortinet fortiweb
Fortinet |
|
| CPE | cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiweb:6.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:* |
16 Feb 2023, 19:39
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-16 19:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-30303
Mitre link : CVE-2022-30303
CVE.ORG link : CVE-2022-30303
JSON object : View
Products Affected
fortinet
- fortiweb
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')