7.2.0

DATE	CVE	VULNERABILITY TITLE	RISK
2023-12-13	CVE-2023-40716	OS Command Injection vulnerability in Fortinet Fortitester An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup . local low complexity fortinet CWE-78	7.8
2023-09-13	CVE-2023-36642	OS Command Injection vulnerability in Fortinet Fortitester An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. local low complexity fortinet CWE-78	7.8
2023-09-13	CVE-2023-40715	Cleartext Storage of Sensitive Information vulnerability in Fortinet Fortitester A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device. local low complexity fortinet CWE-312	5.5
2023-09-13	CVE-2023-40717	Use of Hard-coded Credentials vulnerability in Fortinet Fortitester A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands. local low complexity fortinet CWE-798	7.8