Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

High-Severity Command Injection Flaws Found in Fortinet’s FortiTester, FortiADC

Cybersecurity solutions provider Fortinet this week announced patches for several vulnerabilities across its product portfolio and informed customers about a high-severity command injection bug in FortiADC.

Cybersecurity solutions provider Fortinet this week announced patches for several vulnerabilities across its product portfolio and informed customers about a high-severity command injection bug in FortiADC.

Tracked as CVE-2022-39947 (CVSS score of 8.6), the security defect was identified in the FortiADC web interface and could lead to arbitrary code execution.

“An improper neutralization of special elements used in an OS command vulnerability in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests,” Fortinet explains.

The issue impacts FortiADC versions 5.4.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x, and will be addressed with the release of FortiADC 6.2.4 and 7.0.2, Fortinet notes in its advisory.

On Tuesday, the company also announced patches for multiple high-severity command injection flaws in FortiTester.

Collectively tracked as CVE-2022-35845 (CVSS score of 7.6), the bugs are described as an improper neutralization of special elements that could lead to arbitrary command execution in the underlying shell. Authentication is required to exploit this vulnerability.

According to Fortinet, the issue impacts FortiTester versions 2.x.x, 3.x.x, 4.x.x, 7.x, and 7.1.0, and was addressed with the release of FortiTester versions 3.9.2, 4.2.1, 7.1.1, and 7.2.0.

Three other vulnerabilities that Fortinet addressed this week have a severity rating of ‘medium’ and are described as an incorrect user management issue in FortiManager leading to passwordless admin in FortiGate, an improper neutralization of input bug in FortiPortal leading to cross-site scripting (XSS), and an improper neutralization of CRLF sequences flaw in FortiWeb leading to arbitrary header injection.

Advertisement. Scroll to continue reading.

The company makes no mention of any of these vulnerabilities being exploited in attacks. Additional information on the security flaws can be found on Fortinet’s PSIRT page.

Related: Fortinet Patches High-Severity Authentication Bypass Vulnerability in FortiOS

Related: Fortinet Admits Many Devices Still Unprotected Against Exploited Vulnerability

Related: Fortinet Patches 6 High-Severity Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights