Command Injection Vulnerability Affecting FortiManager and FortiAnalyzer
An OS command injection vulnerability has been uncovered in Fortinet FortiManager and FortiAnalyzer. It could allow a malicious user to execute arbitrary system commands with elevated privileges.
Description
Technical context and vulnerability details
FortiManager and FortiAnalyzer are critical management and audit appliances for enterprise networks, governing access controls and compliance log retention.
These products are affected by the following vulnerabilities:
CVE-2022-27483: Operating system command injection vulnerability (CWE-78) via the command-line interface or unsanitized configuration calls. It allows a privileged user to bypass restrictions and spawn uncontrolled shell processes. Classified High with a CVSS v3.1 base score of 8.8.
Potential Risks & Impact
Potential consequences upon exploitation
- Execution of arbitrary shell commands with underlying operating system privileges;
- Risk of tampering with stored configuration databases and security certificates;
- Severe impact on the confidentiality and integrity of administrative components.
Affected systems
Products, components and targeted versions
- FortiAnalyzer 7.0: versions 7.0.0 to 7.0.3;
- FortiAnalyzer 6.4: versions 6.4.0 to 6.4.7;
- FortiAnalyzer 6.2 and 6.0: all versions (end-of-life);
- FortiManager 7.0: versions 7.0.0 to 7.0.3;
- FortiManager 6.4: versions 6.4.0 to 6.4.7.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately upgrade FortiManager and FortiAnalyzer to version 7.0.4 or higher;
- Apply patch version 6.4.8 on deployments running the 6.4 branch;
- Migrate legacy 6.2 and 6.0 deployments to supported releases without delay.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.