CVE-2023-42788: OS command injection

Published Oct 10, 2023

Updated

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

Other sources

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

— FortiGuard

Affected Software

27 affected componentsFixes available

Fortinet FortiAnalyzer>=6.2.0<=6.2.11

Fortinet FortiAnalyzer>=6.4.0<=6.4.12

Fortinet FortiAnalyzer>=7.0.0<=7.0.8

Fortinet FortiAnalyzer>=7.2.0<=7.2.3

Fortinet FortiAnalyzer=7.4.0

Fortinet FortiManager>=6.2.0<=6.2.11

Fortinet FortiManager>=6.4.0<=6.4.12

Fortinet FortiManager>=7.0.0<=7.0.8

Fortinet FortiManager>=7.2.0<=7.2.3

Fortinet FortiManager=7.4.0

Fortinet FortiAnalyzer=.

Fortinet FortiAnalyzer>=7.2.0<=7.2.3

Fortinet FortiAnalyzer>=7.0.0<=7.0.8

Fortinet FortiAnalyzer>=6.4.0<=6.4.12

Fortinet FortiAnalyzer>=6.2.0<=6.2.11

Fortinet FortiAnalyzer-BigData>=7.2.0<=7.2.5

Fortinet FortiAnalyzer-BigData>=7.0

Fortinet FortiAnalyzer-BigData>=6.4

Fortinet FortiAnalyzer-BigData>=6.2

Fortinet FortiManager=.

Fortinet FortiManager>=7.2.0<=7.2.3

Fortinet FortiManager>=7.0.0<=7.0.8

Fortinet FortiManager>=6.4.0<=6.4.12

Fortinet FortiManager>=6.2.0<=6.2.11

Fortinet FortiManager Cloud>=7.2.1<=7.2.3

Fortinet FortiManager Cloud>=7.0.1<=7.0.8

Fortinet FortiManager Cloud>=6.4

Remediation

Information

Please upgrade to FortiAnalyzer version 7.4.1 or above Please upgrade to FortiAnalyzer version 7.2.4 or above Please upgrade to FortiAnalyzer version 7.0.9 or above Please upgrade to FortiAnalyzer version 6.4.13 or above Please upgrade to FortiAnalyzer version 6.2.12 or above Please upgrade to FortiManager version 7.4.1 or above Please upgrade to FortiManager version 7.2.4 or above Please upgrade to FortiManager version 7.0.9 or above Please upgrade to FortiManager version 6.4.13 or above Please upgrade to FortiManager version 6.2.12 or above

Event History

Oct 10, 2023

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

RemedyDescriptionSeverityWeakness

Jan 27, 2025

Advisory Published

via FortiGuard·09:01 AM

Jun 10, 2025

News Published

via The Register·11:38 PM

News Published

via The Register·11:44 PM

Frequently Asked Questions

What is the vulnerability ID of this security issue?

The vulnerability ID of this security issue is CVE-2023-42788.

What is the severity level of CVE-2023-42788?

The severity level of CVE-2023-42788 is high (7.8).

Which software versions are affected by CVE-2023-42788?

FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12, and version 6.2.0 through 6.2.11 are affected by CVE-2023-42788.

What is the Common Weakness Enumeration (CWE) ID of CVE-2023-42788?

The Common Weakness Enumeration (CWE) ID of CVE-2023-42788 is CWE-78.

How can I find more information about CVE-2023-42788?

You can find more information about CVE-2023-42788 at the following link: [link](https://fortiguard.com/psirt/FG-IR-23-167).