Vulnerability · Published Apr 6, 2022 · Assigned by fortinet
CVE-2021-26104
High 7.8
In plain English
A high-severity security flaw in Fortinet FortiManager, FortiAnalyzer, FortiPortal from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities).
Official description
Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortinet FortiManager, FortiAnalyzer, FortiPortal | FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below |
References
- https://fortiguard.com/advisory/FG-IR-21-037 x_refsource_CONFIRM
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm x_refsource_MISC