CVE-2022-30303: OS Command Injection
Published Feb 16, 2023
·Updated
An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as root user via crafted HTTP requests.
Affected Software
6 affected components
Fortinet FortiWeb>=6.3.0<6.3.20
Fortinet FortiWeb=6.4.0
Fortinet FortiWeb=6.4.1
Fortinet FortiWeb=6.4.2
Fortinet FortiWeb=7.0.0
Fortinet FortiWeb=7.0.1
Remediation
Patch Available
Information
Please upgrade to FortiWeb version 7.0.2 or above Please upgrade to FortiWeb version 6.3.20 or above
Event History
Feb 16, 2023
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-30303.
2
What is the severity of CVE-2022-30303?
The severity of CVE-2022-30303 is high, with a severity value of 8.8.
3
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-78.
4
Which versions of FortiWeb are affected by CVE-2022-30303?
FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, and 6.4.0 are affected by CVE-2022-30303.
5
How can an attacker exploit CVE-2022-30303?
An authenticated attacker can exploit CVE-2022-30303 by executing arbitrary shell code as the 'root' user via crafted HTTP requests.