CVE-2021-36180

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-78

Affected Products (10)

fortinet · fortiwebvulnerable

References (2)

https://fortiguard.com/advisory/FG-IR-21-120

PatchVendor Advisory

https://fortiguard.com/advisory/FG-IR-21-120

PatchVendor Advisory