PT-2023-27610 · Fortinet · Fortitester

Publicado 2023-12-12 · Atualizado 2023-12-15 · CVE-2023-40716

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiTester versions 2.3.0 through 7.2.3

Description An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup.

Recommendations For FortiTester versions 2.3.0 through 7.2.3, consider disabling the execute restore/backup functionality until a patch is available to prevent exploitation. Restrict access to the command line interpreter to minimize the risk of unauthorized command execution. Avoid using specifically crafted arguments when running execute restore/backup until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-40716

Produtos afetados

Fortitester

Referências · 8

• https://t.me/cvenotify/63444 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-40716 · Nota de Segurança
• https://t.me/cvenotify/63804 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1734902112633426310 · Publicação no Twitter
• https://fortiguard.com/psirt/FG-IR-22-345 · Aviso do Fabricante
• https://t.me/cvenotify/63406 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40716 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1734828594633867330 · Publicação no Twitter