Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HFortinet Fortiportal
APPFortinet3.2.0 – 3.2.24.0.0 – 4.0.44.1.0 – 4.1.24.2.0 – 4.2.45.0.0 – 5.0.35.1.0 – 5.1.25.2.0 – 5.2.6 (bez)5.3.0 – 5.3.6 (bez)6.0.0 – 6.0.5 (bez)
Powiązane podatności
A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and bel...
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an atta...
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker t...
An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 th...
A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7...