An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or commands via the CLI.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-23-170 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
03 Feb 2025, 20:49
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.7 |
| CPE | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:* |
|
| First Time |
Fortinet fortimail
Fortinet fortirecorder Fortinet |
|
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-23-170 - Vendor Advisory |
14 Jan 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-14 14:15
Updated : 2025-02-03 20:49
NVD link : CVE-2024-56497
Mitre link : CVE-2024-56497
JSON object : View
Products Affected
fortinet
- fortirecorder
- fortimail
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')