FG-IR-24-007: Pervasive SQL injection in DAS component
An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-007?
The severity of FG-IR-24-007 is considered high due to its potential for allowing unauthorized code execution through SQL Injection.
How do I fix FG-IR-24-007?
To fix FG-IR-24-007, update FortiClientEMS to version 7.2.3 or later if using versions 7.2.0 to 7.2.2, or to version 7.0.11 or later for versions 7.0.1 to 7.0.10.
What is the impact of FG-IR-24-007?
The impact of FG-IR-24-007 includes the ability for an unauthenticated attacker to execute unauthorized commands on the FortiClientEMS system.
Which versions of FortiClientEMS are affected by FG-IR-24-007?
FG-IR-24-007 affects FortiClientEMS versions 7.2.0 to 7.2.2 and 7.0.1 to 7.0.10.
Is FG-IR-24-007 only an issue for authenticated users?
No, FG-IR-24-007 allows unauthenticated attackers to exploit the vulnerability, making it a significant security risk.