Sign-up

ID

VAR-202112-0406


CVE

CVE-2021-36195


TITLE

FortiWeb  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-016044

DESCRIPTION

Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments. FortiWeb for, OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiWeb is a web application layer firewall developed by Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, etc., to ensure the security of web applications and protect sensitive database content

Trust: 1.71

sources: NVD: CVE-2021-36195 // JVNDB: JVNDB-2021-016044 // VULHUB: VHN-398105

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwebscope:eqversion:6.4.1

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:eqversion:6.1.1

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:lteversion:6.3.15

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:lteversion:6.2.5

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.3.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:eqversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:eqversion:6.1.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:gteversion:6.2.0

Trust: 1.0

vendor:fortinetmodel:fortiwebscope:eqversion:6.1.2

Trust: 1.0

vendor:フォーティネットmodel:fortiwebscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiwebscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-016044 // NVD: CVE-2021-36195

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-36195
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2021-36195
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-36195
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202112-700
value: MEDIUM

Trust: 0.6

VULHUB: VHN-398105
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-36195
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-398105
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-36195
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-36195
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 0.8
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2021-36195
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-398105 // JVNDB: JVNDB-2021-016044 // CNNVD: CNNVD-202112-700 // NVD: CVE-2021-36195 // NVD: CVE-2021-36195

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-398105 // JVNDB: JVNDB-2021-016044 // NVD: CVE-2021-36195

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-700

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202112-700

PATCH

title:FG-IR-21-157url:https://www.fortiguard.com/psirt/FG-IR-21-157

Trust: 0.8

title:Fortinet FortiWeb Repair measures for operating system command injection vulnerability in operating systemurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=174993

Trust: 0.6

title: - url:https://www.theregister.co.uk/2021/04/02/qnap_bug_nas/

Trust: 0.1

sources: VULMON: CVE-2021-36195 // JVNDB: JVNDB-2021-016044 // CNNVD: CNNVD-202112-700

EXTERNAL IDS

db:NVDid:CVE-2021-36195

Trust: 3.4

db:JVNDBid:JVNDB-2021-016044

Trust: 0.8

db:CNNVDid:CNNVD-202112-700

Trust: 0.7

db:VULHUBid:VHN-398105

Trust: 0.1

db:VULMONid:CVE-2021-36195

Trust: 0.1

sources: VULHUB: VHN-398105 // VULMON: CVE-2021-36195 // JVNDB: JVNDB-2021-016044 // CNNVD: CNNVD-202112-700 // NVD: CVE-2021-36195

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-157

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-36195

Trust: 1.4

url:https://www.theregister.co.uk/2021/04/02/qnap_bug_nas/

Trust: 0.1

sources: VULHUB: VHN-398105 // VULMON: CVE-2021-36195 // JVNDB: JVNDB-2021-016044 // CNNVD: CNNVD-202112-700 // NVD: CVE-2021-36195

SOURCES

db:VULHUBid:VHN-398105
db:VULMONid:CVE-2021-36195
db:JVNDBid:JVNDB-2021-016044
db:CNNVDid:CNNVD-202112-700
db:NVDid:CVE-2021-36195

LAST UPDATE DATE

2024-08-14T14:11:10.075000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-398105date:2021-12-10T00:00:00
db:JVNDBid:JVNDB-2021-016044date:2022-12-05T07:29:00
db:CNNVDid:CNNVD-202112-700date:2021-12-17T00:00:00
db:NVDid:CVE-2021-36195date:2021-12-10T15:55:57.457

SOURCES RELEASE DATE

db:VULHUBid:VHN-398105date:2021-12-08T00:00:00
db:JVNDBid:JVNDB-2021-016044date:2022-12-05T00:00:00
db:CNNVDid:CNNVD-202112-700date:2021-12-08T00:00:00
db:NVDid:CVE-2021-36195date:2021-12-08T19:15:09.837