CVE-2019-15710 - An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands

Back Back to CVE browser

HIGH

An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands

Published Oct 31, 2019

7.2

HIGH

CVSS 3.1

EPSS 1.91%

Description

An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands.

Affected products

Vendor Fortinet Product FortiExtender Default
n/a
- Version
  4.0.0 and below
  Status
  affected
  Constraints
  -
- Version
  4.1.0 to 4.1.1
  Status
  affected
  Constraints
  -