FG-IR-23-419: FortiManager - Code Injection via Jinja Template
An improper neutralization of special elements used in a template engine [CWE-1336] vulnerability in FortiManager provisioning templates may allow a local authenticated attacker with at least read-only permissions to execute arbitrary code via specially crafted templates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-419?
The FG-IR-23-419 vulnerability is categorized as a high severity issue due to its potential for arbitrary code execution.
Who is affected by FG-IR-23-419?
The FG-IR-23-419 vulnerability affects FortiManager versions between 7.0.0 and 7.4.1.
How do I fix FG-IR-23-419?
To fix FG-IR-23-419, upgrade your FortiManager to version 7.4.2 or later, 7.2.5 or later, or 7.0.11 or later.
What can an attacker achieve with FG-IR-23-419?
A local authenticated attacker with read-only permissions can execute arbitrary code through specially crafted provisioning templates due to FG-IR-23-419.
What type of security issue is FG-IR-23-419 classified under?
FG-IR-23-419 is classified under improper neutralization of special elements used in a template engine, as per CWE-1336.