PT-2023-6006 · Fortinet · Fortimanager

Published 2023-10-10 · Updated 2023-10-13 · CVE-2023-41838

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.2.0 through 7.2.3 FortiManager version 7.4.0

Description The issue is related to an improper neutralization of special elements used in an os command, which may allow an attacker to execute unauthorized code or commands via the FortiManager cli. This can be exploited due to insufficient checking of arguments passed to a command, potentially enabling an attacker to execute arbitrary commands or code.

Recommendations For FortiManager versions 7.2.0 through 7.2.3, consider disabling the vulnerable command execution functionality until a patch is available. For FortiManager version 7.4.0, restrict access to the FortiManager cli to minimize the risk of exploitation. As a temporary workaround, avoid using the FortiManager cli for executing commands that may contain special elements until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-06707

CVE-2023-41838

Affected Products

Fortimanager

References · 6

• https://fortiguard.com/psirt/FG-IR-23-169 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06707 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41838 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41838 · Vendor Advisory
• https://t.me/cvenotify/59196 · Telegram Post
• https://t.me/cibsecurity/71967 · Telegram Post