Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Fortinet FortiWeb OS Command Injection allows takeover servers remotely

Security Affairsby @securityaffairs ()2 min read2 · 1 read
Read at securityaffairs.com
Analyze CVE-2020-29015 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2020-29015
Tags
cve-2020-29015vulnerability

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2020-29015
A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute…
9.83%

From the original article

2 min read at securityaffairs.com

Fortinet addresses a command injection vulnerability that can allow attackers to take complete control of servers running vulnerable FortiWeb WAF installs. An authenticated attacker could execute arbitrary commands as the root user on the underlying system via the SAML server configuration page.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.