CVE-2023-42788: OS command injection

Published Oct 10, 2023

Updated

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

Other sources

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

— FortiGuard

Affected Software

27 affected componentsFixes available

Fortinet FortiAnalyzer>=6.2.0<=6.2.11

Fortinet FortiAnalyzer>=6.4.0<=6.4.12

Fortinet FortiAnalyzer>=7.0.0<=7.0.8

Fortinet FortiAnalyzer>=7.2.0<=7.2.3

Fortinet FortiAnalyzer=7.4.0

Fortinet FortiManager>=6.2.0<=6.2.11

Fortinet FortiManager>=6.4.0<=6.4.12

Fortinet FortiManager>=7.0.0<=7.0.8

Fortinet FortiManager>=7.2.0<=7.2.3

Fortinet FortiManager=7.4.0

Fortinet FortiAnalyzer=.

Fortinet FortiAnalyzer>=7.2.0<=7.2.3

Fortinet FortiAnalyzer>=7.0.0<=7.0.8

Fortinet FortiAnalyzer>=6.4.0<=6.4.12

Fortinet FortiAnalyzer>=6.2.0<=6.2.11

Fortinet FortiAnalyzer-BigData>=7.2.0<=7.2.5

Fortinet FortiAnalyzer-BigData>=7.0

Fortinet FortiAnalyzer-BigData>=6.4

Fortinet FortiAnalyzer-BigData>=6.2

Fortinet FortiManager=.

Fortinet FortiManager>=7.2.0<=7.2.3

Fortinet FortiManager>=7.0.0<=7.0.8

Fortinet FortiManager>=6.4.0<=6.4.12

Fortinet FortiManager>=6.2.0<=6.2.11

Fortinet FortiManager Cloud>=7.2.1<=7.2.3

Fortinet FortiManager Cloud>=7.0.1<=7.0.8

Fortinet FortiManager Cloud>=6.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.1
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.4
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.0.9
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 6.4.13
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 6.2.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.1
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.4
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.0.9
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 6.4.13
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 6.2.12

Event History

Oct 10, 2023

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

RemedyDescriptionSeverityWeakness

Jun 10, 2025

News Published

via The Register·11:38 PM

Frequently Asked Questions

What is the vulnerability ID of this security issue?

The vulnerability ID of this security issue is CVE-2023-42788.

What is the severity level of CVE-2023-42788?

The severity level of CVE-2023-42788 is high (7.8).

Which software versions are affected by CVE-2023-42788?

FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12, and version 6.2.0 through 6.2.11 are affected by CVE-2023-42788.

What is the Common Weakness Enumeration (CWE) ID of CVE-2023-42788?

The Common Weakness Enumeration (CWE) ID of CVE-2023-42788 is CWE-78.

How can I find more information about CVE-2023-42788?

You can find more information about CVE-2023-42788 at the following link: [link](https://fortiguard.com/psirt/FG-IR-23-167).