PT-2021-6917 · Fortinet · Fortiwlm

Published 2021-11-02 · Updated 2021-11-04 · CVE-2021-36185

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.6.1 and below

Description The issue exists due to improper neutralization of special elements used in an OS command, allowing an attacker to execute unauthorized code or commands via crafted HTTP requests. This can be exploited by a remote attacker using a specially formed HTTP request.

Recommendations For Fortinet FortiWLM versions 8.6.1 and below, update to a version above 8.6.1 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-02669

CVE-2021-36185

Affected Products

Fortiwlm

References · 4

• https://bdu.fstec.ru/vul/2022-02669 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36185 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36185 · Vendor Advisory