CVE-2024-50566

Published Jan 14, 2025

Last updated 4 months ago

CVSS high 7.2

Overview

Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.1 through 7.2.8 may allow an authenticated remote attacker to execute unauthorized code via FGFM crafted requests.
Source: psirt@fortinet.com
NVD status: Modified
Products: fortimanager, fortimanager_cloud

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@fortinet.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CBA16B3B-9767-4B61-BA35-2DDF70D66D09",
            "versionEndExcluding": "7.2.9",
            "versionStartIncluding": "7.2.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "24796E3A-DDCB-4949-9080-5DCEEECF0B6C",
            "versionEndExcluding": "7.4.6",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "241A8930-4ADA-4380-AA42-F10B28487595",
            "versionEndExcluding": "7.6.2",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "57B085BA-AF25-4EE9-8EC6-BD588F3C90CF",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9FBDCAD3-019A-4F46-AB5D-448E525E4E94",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3C4D647A-5EA1-4047-9E59-987FC8A74F0B",
            "versionEndExcluding": "7.6.2",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References