CVE-2024-23108

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Fortinet	FortiSIEM	>= 7.1.0, <= 7.1.1; >= 7.0.0, <= 7.0.2; >= 6.7.0, <= 6.7.8; >= 6.6.0, <= 6.6.3; >= 6.5.0, <= 6.5.2; >= 6.4.0, <= 6.4.3

References

https://fortiguard.com/psirt/FG-IR-23-130Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-130Vendor Advisory
https://github.com/horizon3ai/CVE-2024-23108

Timeline

Published: Feb 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-231099.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to CVE-2024-23115.4The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including,CVE-2024-231107.8A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.CVE-2024-231114.8An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and CVE-2024-231124.3An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 CVE-2024-231139.8A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo CVE-2024-231149.8Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe de CVE-2024-231157.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod CVE-2024-231167.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar CVE-2024-231177.2Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2024-231187.2Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2024-231198.8Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr