VULNERABILITY INTELLIGENCE

CVE-2023-23779

CVSS score6.8 MEDIUM
EPSS probability1.32%
CISA KEVNot currently listed
Published2023-02-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

Weakness classification

  • psirt@fortinet.com: CWE-78
  • nvd@nist.gov: CWE-78

Primary references