CVE-2021-36180: OS Command Injection
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-36180?
CVE-2021-36180 is a vulnerability in FortiWeb management interface that allows an authenticated attacker to execute unauthorized code or commands.
Which versions of FortiWeb are affected by CVE-2021-36180?
FortiWeb versions 5.8.0 to 5.8.6, 6.0.0 to 6.0.7, 6.2.0 to 6.2.5, and 6.3.0 to 6.3.15 are affected by CVE-2021-36180.
What is the severity of CVE-2021-36180?
CVE-2021-36180 has a severity score of 8.8 (high).
How can an attacker exploit CVE-2021-36180?
An attacker can exploit CVE-2021-36180 by sending crafted parameters in HTTP requests to the FortiWeb management interface.
Is there a fix for CVE-2021-36180?
Yes, Fortinet has released patches to address CVE-2021-36180. It is recommended to update to the latest version of FortiWeb.