PT-2023-24279 · Fortinet · Fortinac

Publicado 2023-05-22 · Atualizado 2025-03-14 · CVE-2023-33300

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Fortinet FortiNAC versions 7.2.1 and earlier, 9.4.3 and earlier

Description: The issue is related to an improper neutralization of special elements used in a command, also known as 'command injection', which allows an attacker to gain limited, unauthorized file access. This can be achieved by sending a specifically crafted request in inter-server communication port.

Recommendations: For Fortinet FortiNAC versions 7.2.1 and earlier, consider restricting access to the inter-server communication port as a temporary workaround until a patch is available. For Fortinet FortiNAC version 9.4.3 and earlier, restrict access to the inter-server communication port to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2025-02838

CVE-2023-33300

Produtos afetados

Fortinac

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-33300 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33300 · Aviso do Fabricante
• https://t.me/purple_medved/50 · Publicação no Telegram
• https://t.me/cvedetector/20324 · Publicação no Telegram
• https://fortiguard.com/psirt/FG-IR-23-096 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-02838 · Nota de Segurança
• https://t.me/true_secator/4536 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1900582040975835407 · Publicação no Twitter
• https://vuldb.com/?id.232277 · Nota