Fortinet Fortinet FortiManager, FortiAnalyzer

CVE-2022-27483

HIGH 7.2

En bref

Source: NVD
EPSS: EPSS 2.18 % · centile 82 (2026-11-01)
État: PUBLISHED
Publiée: 2022-07-18 16:40 UTC
Mise à jour: 2024-10-25 13:30 UTC
Attribuée par: fortinet
Statut NVD: Modified

Rechercher sur…

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.

Faiblesses (CWE)

CWE-78 — Injection de commande système

Références

https://fortiguard.com/psirt/FG-IR-22-049

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C	fortinet
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · psirt@fortinet.com (Secondary)
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2022-31984
GCVE · GCVE-0-2022-27483

Avis du CERT-FR

CERTFR-2022-AVI-613 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.11
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.9
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.7
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.3
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.11
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.9
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.7
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.3

Produits affectés

Produit	Versions
Fortinet · Fortinet FortiManager, FortiAnalyzer	affected FortiManager 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0; FortiAnalyzer 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0

Produit

Versions

Fortinet · Fortinet FortiManager, FortiAnalyzer

affected FortiManager 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0; FortiAnalyzer 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Fortinet Fortinet FortiManager, FortiAnalyzer