| IR Number | FG-IR-22-254 |
| Date | Mar 7, 2023 |
| Severity |
High |
| CVSSv3 Score | 7.2 |
| Impact | Execute unauthorized code or commands |
| CVE ID | CVE-2022-39951 |
| CVRF | Download |
Refine Search
PSIRT Advisories
FortiWeb - command injection in webserver
Summary
An improper neutralization of special elements used in an OS command vulnerability ('OS Command Injection') [CWE-78] in FortiWeb may allow authenticated users to execute unauthorized code or commands via specifically crafted HTTP requests.
Affected Products
FortiWeb version 7.0.0 through 7.0.2FortiWeb version 6.3.6 through 6.3.20
FortiWeb 6.4 all versions
Solutions
Please upgrade to FortiWeb version 7.2.0 or abovePlease upgrade to FortiWeb version 7.0.3 or above
Please upgrade to FortiWeb version 6.3.21 or above