CVE-2023-36553

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-365549.8A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 t CVE-2023-365555.4An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to exe CVE-2023-365568.8An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6 CVE-2023-365577.8PrintHTML API Remote Code Execution Vulnerability CVE-2023-365585.5ASP.NET Core Security Feature Bypass Vulnerability CVE-2023-365594.2Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2023-36569.8cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unau CVE-2023-365608.8ASP.NET Security Feature Bypass Vulnerability CVE-2023-365617.3Azure DevOps Server Elevation of Privilege Vulnerability CVE-2023-365627.1Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2023-365635.5Microsoft WordPad Information Disclosure Vulnerability CVE-2023-365646.5Windows Search Security Feature Bypass Vulnerability