From bleepingcomputer.com
Fortinet has delayed patching a zero-day command injection vulnerability found in the FortiWeb web application firewall (WAF) until the end of August.
Successful exploitation can let authenticated attackers execute arbitrary commands as the root user on the underlying system via the SAML server configuration page.
While attackers must be authenticated to the management interface of the targeted FortiWeb device to abused this bug, they can easily chain it with other vulnerabilities such as the CVE-2020-29015 authentication bypass to take full control of vulnerable servers.
“An attacker can leverage this vulnerability to take complete control of the affected device, with the highest possible privilege,” Rapid7 explained.