CVE-2023-48782
Published: 13 December 2023
Summary
CVE-2023-48782 is a high-severity OS Command Injection (CWE-78) vulnerability in Fortinet Fortiwlm. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-48782 is an OS command injection vulnerability, tracked under CWE-78, that affects Fortinet FortiWLM versions 8.6.0 through 8.6.5. The flaw stems from improper neutralization of special elements in OS commands and can be triggered through specifically crafted parameters in HTTP GET requests, as reflected in its CVSS 3.1 score of 8.8.
An attacker with network access and low-level privileges can exploit the issue without user interaction to execute unauthorized code or commands on the affected system, resulting in full compromise of confidentiality, integrity, and availability.
Fortinet has published advisory FG-IR-23-450 detailing the issue and associated remediation guidance.
The EPSS score reached a modest peak of 0.0570 after disclosure before receding to the current value of 0.0386, indicating limited but observable post-publication interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-52815
Vulnerability details
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.