{"id":"CVE-2023-27995","state":"PUBLISHED","title":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute ","description":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload.","publishedAt":"2023-04-11T16:05:43.728Z","updatedAt":"2024-10-23T14:30:21.861Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiSOAR"],"affected":[{"vendor":"Fortinet","product":"FortiSOAR","defaultStatus":"unaffected","versions":[{"version":"7.3.0","status":"affected","lessThanOrEqual":"7.3.1","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-051"],"weaknesses":["CWE-1336"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/27xxx/CVE-2023-27995.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-27995","state":"PUBLISHED","datePublished":"2023-04-11T16:05:43.728Z","dateUpdated":"2024-10-23T14:30:21.861Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-03-09T10:09:33.119Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload."}],"affected":[{"vendor":"Fortinet","product":"FortiSOAR","defaultStatus":"unaffected","versions":[{"version":"7.3.0","status":"affected","lessThanOrEqual":"7.3.1","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-051","name":"https://fortiguard.com/psirt/FG-IR-23-051"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1336","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-04-11T16:05:43.728Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiSOAR version 8.0.0 or above Please upgrade to FortiSOAR version 7.3.2 or above Please upgrade to FortiSOAR version 7.2.3 or above Please upgrade to FortiSOAR version 7.0.4 or above Please upgrade to FortiSOAR version 6.6.0 or above Please upgrade to FortiSOAR version 6.4.5 or above "}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-051","name":"https://fortiguard.com/psirt/FG-IR-23-051","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T12:23:30.814Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:11:23.807257Z","id":"CVE-2023-27995","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T14:30:21.861Z"}}]}}}