Vulnerability Details CVE-2023-48791
An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted arguments in the Schedule System Backup page field.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.034
EPSS Ranking 86.9%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2023-48791
-
cpe:2.3:a:fortinet:fortiportal:7.0.0
-
cpe:2.3:a:fortinet:fortiportal:7.0.1
-
cpe:2.3:a:fortinet:fortiportal:7.0.2
-
cpe:2.3:a:fortinet:fortiportal:7.0.3
-
cpe:2.3:a:fortinet:fortiportal:7.0.4
-
cpe:2.3:a:fortinet:fortiportal:7.0.5
-
cpe:2.3:a:fortinet:fortiportal:7.0.6
-
cpe:2.3:a:fortinet:fortiportal:7.2.0