CVE-2023-41838

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Fortinet	FortiAnalyzer	7.4.0; >= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.8; >= 6.4.0, <= 6.4.12; >= 6.2.0, <= 6.2.11
Fortinet	FortiManager	7.4.0; >= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.8; >= 6.4.0, <= 6.4.12; >= 6.2.0, <= 6.2.11

References

https://fortiguard.com/psirt/FG-IR-23-169Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-169Vendor Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-41849.8A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical. This issue affects some unknown proc CVE-2023-418407.8A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious CVE-2023-418418.8An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin CVE-2023-418426.7A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unau CVE-2023-418435.4A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through CVE-2023-418445.4A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through CVE-2023-418467.8A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All CVE-2023-418475.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WEN Solutions Notice Bar plugin <= 3.1.0 versions.CVE-2023-418485.3Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2023-418495.3Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security L CVE-2023-41859.8A vulnerability was found in SourceCodester Online Hospital Management System 1.0. It has been classified as critical. Affected is an unknow CVE-2023-418508.8Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <= 1.2 versions.