CVE-2024-23108: OS Command Injection

Q: What is the severity of CVE-2024-23108?

CVE-2024-23108 is considered a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2024-23108?

To fix CVE-2024-23108, upgrade FortiSIEM to the latest version that is not affected by this vulnerability.

Q: Which versions of FortiSIEM are affected by CVE-2024-23108?

CVE-2024-23108 affects FortiSIEM versions 6.4.0 through 7.1.1 inclusive.

Q: What type of vulnerability is CVE-2024-23108?

CVE-2024-23108 is an os command injection vulnerability, allowing attackers to execute unauthorized commands.

Q: Is there an exploit available for CVE-2024-23108?

Details about specific exploits for CVE-2024-23108 have not been publicly disclosed, but the vulnerability's nature poses significant risks.

Published Feb 5, 2024

Updated

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Affected Software

9 affected components

Fortinet FortiSIEM>=6.4.0<=6.4.2

Fortinet FortiSIEM>=6.5.0<=6.5.2

Fortinet FortiSIEM>=6.6.0<=6.6.3

Fortinet FortiSIEM>=6.7.0<=6.7.8

Fortinet FortiSIEM>=7.0.0<=7.0.2

Fortinet FortiSIEM=7.1.0

Fortinet FortiSIEM=7.1.1

Fortinet FortiOS

Fortinet FortiProxy

Remediation

Information

Please upgrade to FortiSIEM version 7.1.2 or above Please upgrade to FortiSIEM version 7.0.3 or above Please upgrade to FortiSIEM version 6.7.9 or above Please upgrade to FortiSIEM version 6.6.4 or above Please upgrade to FortiSIEM version 6.5.3 or above Please upgrade to FortiSIEM version 6.4.4 or above Please upgrade to upcoming FortiSIEM version 7.2.0 or above

Event History

Feb 5, 2024

CVE Published

via MITRE·01:26 PM

Data Sourced

via MITRE·01:26 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 6, 2024

News Published

via The Register·01:30 PM

News Published

via The Register·01:33 PM

Feb 7, 2024

News Published

via BleepingComputer·01:29 PM

News Published

via BleepingComputer·01:31 PM

Feb 8, 2024

News Published

via BleepingComputer·12:55 AM

Feb 9, 2024

News Published

via The Register·02:30 PM

News Published

via BleepingComputer·09:02 PM

May 28, 2024

News Published

via BleepingComputer·04:16 PM

Jan 14, 2026

News Published

via BleepingComputer·06:51 PM

Invalid Date

News Published

via BleepingComputer·Invalid Date

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-23108?

CVE-2024-23108 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2024-23108?

To fix CVE-2024-23108, upgrade FortiSIEM to the latest version that is not affected by this vulnerability.

Which versions of FortiSIEM are affected by CVE-2024-23108?

CVE-2024-23108 affects FortiSIEM versions 6.4.0 through 7.1.1 inclusive.

What type of vulnerability is CVE-2024-23108?

CVE-2024-23108 is an os command injection vulnerability, allowing attackers to execute unauthorized commands.

Is there an exploit available for CVE-2024-23108?

Details about specific exploits for CVE-2024-23108 have not been publicly disclosed, but the vulnerability's nature poses significant risks.

CVE-2024-23108: OS Command Injection

Affected Software

Remediation

Information

Event History

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-23108?

How do I fix CVE-2024-23108?

Which versions of FortiSIEM are affected by CVE-2024-23108?

What type of vulnerability is CVE-2024-23108?

Is there an exploit available for CVE-2024-23108?

Company

Resources

Contact