CVE-2021-26116: OS Command Injection
Published Apr 6, 2022
·Updated
An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
Affected Software
1 affected component
Fortinet FortiAuthenticator>=5.0.0<6.3.1
Event History
Apr 6, 2022
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2021-26116.
2
What is the severity of CVE-2021-26116?
The severity of CVE-2021-26116 is high with a CVSS score of 8.8.
3
How does CVE-2021-26116 impact FortiAuthenticator?
CVE-2021-26116 allows an authenticated attacker to execute unauthorized commands in FortiAuthenticator before version 6.3.1.
4
How can an attacker exploit CVE-2021-26116?
An attacker can exploit CVE-2021-26116 by supplying specially crafted arguments to existing commands in FortiAuthenticator.
5
Is there a fix available for CVE-2021-26116?
Yes, the fix for CVE-2021-26116 is available in FortiAuthenticator version 6.3.1 or later.