CVE-2021-22123: high-severity vulnerability in Fortinet FortiWeb
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in FortiWeb's management interface allows authenticated users to inject and run arbitrary system commands through the SAML server configuration page. This could let an attacker take complete control of the affected system.
OS command injection vulnerability in FortiWeb management interface (versions 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x) accessible via SAML server configuration page. Attack requires prior authentication and allows execution of arbitrary OS commands with system privileges, leading to complete system compromise.
In the same product, most dangerous first.