CVE-2020-29017: [FortiDeceptor] OS command injection

Published Jan 4, 2021

Updated

An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary commands on the system by exploiting a command injection vulnerability on the Customization page.

Other sources

Multiple OS command injection vulnerabilities in FortiDeceptor management interface may allow an authenticated user to execute arbitrary commands on the system via specifically crafted web requests.

— FortiGuard

Affected Software

3 affected components

Fortinet FortiDeceptor=3.0.0

Fortinet FortiDeceptor=3.0.1

Fortinet FortiDeceptor=3.1.0

Event History

Jan 4, 2021

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Jan 14, 2021

CVE Published

via MITRE·04:03 PM

Data Sourced

via MITRE·04:03 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-29017?

CVE-2020-29017 is an OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, and 3.0.0.

How does CVE-2020-29017 affect FortiDeceptor?

CVE-2020-29017 allows a remote authenticated attacker to execute arbitrary commands on the FortiDeceptor system.

What is the severity of CVE-2020-29017?

CVE-2020-29017 has a severity rating of 8.8 (Critical).

Which versions of FortiDeceptor are affected by CVE-2020-29017?

FortiDeceptor versions 3.1.0, 3.0.1, and 3.0.0 are affected by CVE-2020-29017.

How can I fix the CVE-2020-29017 vulnerability?

To fix the CVE-2020-29017 vulnerability, FortiDeceptor users should update to a patched version provided by Fortinet.