PT-2017-17674 · Fortinet · Fortiwlc

Publicado 2017-10-26 · Atualizado 2019-10-03 · CVE-2017-7341

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2 through 6.1-5 Fortinet FortiWLC versions 7.0-7 through 7.0-10 Fortinet FortiWLC versions 8.0 through 8.2 Fortinet FortiWLC versions 8.3.0 through 8.3.2

Description The issue allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests, specifically through the file management AP script download webUI page.

Recommendations For Fortinet FortiWLC versions 6.1-2 through 6.1-5, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 7.0-7 through 7.0-10, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 8.0 through 8.2, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 8.3.0 through 8.3.2, consider restricting access to the file management AP script download webUI page until a fix is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-7341

Produtos afetados

Fortiwlc

Referências · 4

• https://fortiguard.com/psirt/FG-IR-17-119 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7341 · Aviso do Fabricante
• http://securityfocus.com/bid/101273 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7341 · Nota de Segurança