nvd-json-data-feeds/CVE-2022/CVE-2022-274xx/CVE-2022-27483.json

{
  "id": "CVE-2022-27483",
  "sourceIdentifier": "psirt@fortinet.com",
  "published": "2022-07-19T14:15:08.500",
  "lastModified": "2022-07-27T07:18:54.910",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands."
    },
    {
      "lang": "es",
      "value": "Una neutralizaci\u00f3n inapropiada de elementos especiales usados en un comando os (\"inyecci\u00f3n de comando os\") en Fortinet FortiManager versiones 7.0.0 hasta 7.0.3, 6.4.0 hasta 6.4.7, 6.2.x y 6.0. x y FortiAnalyzer versi\u00f3n 7.0.0 hasta 7.0.3, versiones 6.4.0 hasta 6.4.7, 6.2.x y 6.0.x, permite a un atacante ejecutar c\u00f3digo shell arbitrario como usuario \"root\" por medio de comandos CLI \"diagnose system\"."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      },
      {
        "source": "psirt@fortinet.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.11",
              "matchCriteriaId": "54813EA4-11C3-430F-82AC-CBD542966E7C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2.0",
              "versionEndIncluding": "6.2.9",
              "matchCriteriaId": "111C793F-C2E0-4042-A269-D40E1815A672"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.4.0",
              "versionEndIncluding": "6.4.7",
              "matchCriteriaId": "4FE9C581-AB9F-4044-8C62-23B5494EFD27"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndIncluding": "7.0.3",
              "matchCriteriaId": "42D096D2-1FCB-43A6-8CF3-3226F631BAC4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndIncluding": "6.0.11",
              "matchCriteriaId": "FD729EF3-1665-4CE7-9FDD-450D5F79A2B9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2.0",
              "versionEndIncluding": "6.2.9",
              "matchCriteriaId": "7D79F4BE-B6BB-414A-A132-D3650B2B5B4F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.4.0",
              "versionEndIncluding": "6.4.7",
              "matchCriteriaId": "105F23CF-6375-402E-A2ED-9827510196EA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndIncluding": "7.0.3",
              "matchCriteriaId": "AA4F8D67-139F-4524-88D4-B32A1580BFBE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-22-049",
      "source": "psirt@fortinet.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}