CVE-2025-47857

{"id": "CVE-2025-47857", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2025-08-12T19:15:29.997", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-253", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo ('inyecci\u00f3n de comando del sistema operativo') [CWE-78] en Fortinet FortiWeb CLI versi\u00f3n 7.6.0 a 7.6.3 y anteriores a 7.4.8 permite que un atacante privilegiado ejecute c\u00f3digo o comando arbitrario a trav\u00e9s de comandos CLI manipulados."}], "lastModified": "2025-08-15T12:25:37.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "176B0C37-8A71-45C8-ABCC-1A07E06B5F32", "versionEndExcluding": "7.4.9", "versionStartIncluding": "7.4.1"}, {"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B739434-1979-43F9-AEC1-D287B1BCA5CA", "versionEndExcluding": "7.6.4", "versionStartIncluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}