« Volver al listado

CVE-2022-33873

Estado: ModificadaCrítica (9.8)—

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the underlying shell.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortitester

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-33873",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-33873",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T14:12:19.545862Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiTester",
          "versions": [
            {
              "status": "affected",
              "version": "FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-18T15:15:09.743",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-22-237",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-22-237",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the underlying shell."
    },
    {
      "lang": "es",
      "value": "Unas vulnerabilidades de neutralización inapropiada de los elementos especiales usados en un comando del Sistema Operativo (\"Inyección de Comandos del Sistema Operativo\") [CWE-78] en los componentes de inicio de sesión de la consola de FortiTester versiones 2.3.0 hasta 3.9.1, 4.0.0 hasta 4.2.0, 7.0.0 hasta 7.1.0, puede permitir a un atacante no autenticado ejecutar un comando arbitrario en el shell subyacente"
    }
  ],
  "lastModified": "2026-06-17T04:49:23.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A56D42B-F3B0-419F-8F1B-2826E28436BD",
              "versionEndExcluding": "3.9.2",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE2EA412-DFA8-4EA8-80B1-081B994AFEDC",
              "versionEndExcluding": "4.2.1",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B708B54C-64C3-4793-8F81-896CFCA2AFF9",
              "versionEndExcluding": "7.1.1",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}