CVE-2023-34991: SQL Injection
First published: Tue Nov 14 2023(Updated: )
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http request.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWLM | >=8.5.0<=8.5.4 | |
| Fortinet FortiWLM | >=8.6.0<=8.6.5 | |
| Fortinet FortiWLM | =8.2.2 | |
| Fortinet FortiWLM | =8.3.0 | |
| Fortinet FortiWLM | =8.3.1 | |
| Fortinet FortiWLM | =8.3.2 | |
| Fortinet FortiWLM | =8.4.0 | |
| Fortinet FortiWLM | =8.4.1 | |
| Fortinet FortiWLM | =8.4.2 |
Remedy
Please upgrade to FortiWLM version 8.6.6 or above Please upgrade to FortiWLM version 8.5.5 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-34991?
CVE-2023-34991 is a vulnerability that allows an attacker to execute unauthorized code or commands via a crafted HTTP request due to improper neutralization of special elements used in an SQL command (SQL injection) in Fortinet FortiWLM.
Which versions of Fortinet FortiWLM are affected by CVE-2023-34991?
Fortinet FortiWLM versions 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.4.0 through 8.4.2, 8.3.0 through 8.3.2, and 8.2.2 are affected by CVE-2023-34991.
How severe is CVE-2023-34991?
CVE-2023-34991 has a severity rating of 9.3 (critical).
How can an attacker exploit CVE-2023-34991?
An attacker can exploit CVE-2023-34991 by sending a crafted HTTP request containing malicious SQL commands.
Is there a fix for CVE-2023-34991?
Yes, it is recommended to update Fortinet FortiWLM to a version that has addressed the vulnerability.
- collector/nvd-api
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/weakness
- agent/type
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortiwlm
- version/fortinet fortiwlm/8.5.0
- version/fortinet fortiwlm/8.5.4
- version/fortinet fortiwlm/8.6.0
- version/fortinet fortiwlm/8.6.5
- version/fortinet fortiwlm/8.2.2
- version/fortinet fortiwlm/8.3.0
- version/fortinet fortiwlm/8.3.1
- version/fortinet fortiwlm/8.3.2
- version/fortinet fortiwlm/8.4.0
- version/fortinet fortiwlm/8.4.1
- version/fortinet fortiwlm/8.4.2