CVE-2021-36180: OS Command Injection
First published: Wed Dec 08 2021(Updated: )
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWeb | >=5.8.0<=5.8.6 | |
| Fortinet FortiWeb | >=6.0.0<=6.0.7 | |
| Fortinet FortiWeb | >=6.2.0<=6.2.5 | |
| Fortinet FortiWeb | >=6.3.0<=6.3.15 | |
| Fortinet FortiWeb | =5.9.0 | |
| Fortinet FortiWeb | =5.9.1 | |
| Fortinet FortiWeb | =6.1.0 | |
| Fortinet FortiWeb | =6.1.1 | |
| Fortinet FortiWeb | =6.4.0 | |
| Fortinet FortiWeb | =6.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-36180?
CVE-2021-36180 is a vulnerability in FortiWeb management interface that allows an authenticated attacker to execute unauthorized code or commands.
Which versions of FortiWeb are affected by CVE-2021-36180?
FortiWeb versions 5.8.0 to 5.8.6, 6.0.0 to 6.0.7, 6.2.0 to 6.2.5, and 6.3.0 to 6.3.15 are affected by CVE-2021-36180.
What is the severity of CVE-2021-36180?
CVE-2021-36180 has a severity score of 8.8 (high).
How can an attacker exploit CVE-2021-36180?
An attacker can exploit CVE-2021-36180 by sending crafted parameters in HTTP requests to the FortiWeb management interface.
Is there a fix for CVE-2021-36180?
Yes, Fortinet has released patches to address CVE-2021-36180. It is recommended to update to the latest version of FortiWeb.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortiweb
- version/fortinet fortiweb/5.8.0
- version/fortinet fortiweb/5.8.6
- version/fortinet fortiweb/6.0.0
- version/fortinet fortiweb/6.0.7
- version/fortinet fortiweb/6.2.0
- version/fortinet fortiweb/6.2.5
- version/fortinet fortiweb/6.3.0
- version/fortinet fortiweb/6.3.15
- version/fortinet fortiweb/5.9.0
- version/fortinet fortiweb/5.9.1
- version/fortinet fortiweb/6.1.0
- version/fortinet fortiweb/6.1.1
- version/fortinet fortiweb/6.4.0
- version/fortinet fortiweb/6.4.1