rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15869 
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-31T19:49:18.000Z
CVE-2020-15870 
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-31T19:42:33.000Z
CVE-2020-15871 
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-31T19:59:01.000Z
CVE-2020-15873 
In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T16:03:45.000Z
CVE-2020-15877 
An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T17:00:16.000Z
CVE-2020-15879 
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T16:59:13.000Z
CVE-2020-15881 
A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:49:17.000Z
CVE-2020-15882 
A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:48:23.000Z
CVE-2020-15883 
A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:42:39.000Z
CVE-2020-15884 
A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:41:43.000Z
CVE-2020-15885 
A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:39:59.000Z
CVE-2020-15886 
A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:37:58.000Z
CVE-2020-15887 
A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T13:36:34.000Z
CVE-2020-15888 
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T21:36:02.000Z
CVE-2020-15889 
Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T21:35:49.000Z
CVE-2020-15890 
LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-21T21:35:32.000Z
CVE-2020-15892 
An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:56:25.000Z
CVE-2020-15893 
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:56:05.000Z
CVE-2020-15894 
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:55:56.000Z
CVE-2020-15895 
An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:55:44.000Z
CVE-2020-15896 
An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NO_NEED_AUTH. If the value of NO_NEED_AUTH is 1, the user has direct access to the webpage without any authentication. By appending a query string NO_NEED_AUTH with the value of 1 to any protected URL, any unauthorized user can access the application directly, as demonstrated by bsc_lan.php?NO_NEED_AUTH=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T18:55:31.000Z
CVE-2020-15897 
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T15:13:40.000Z
CVE-2020-15898 
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-28T18:16:58.000Z
CVE-2020-15899 
Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T16:31:58.000Z
CVE-2020-15900 
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T15:17:14.000Z
CVE-2020-15901 
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T21:29:11.000Z
CVE-2020-15902 
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T21:28:59.000Z
CVE-2020-15903 
An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-09T20:29:24.000Z
CVE-2020-15904 
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-22T22:25:51.000Z
CVE-2020-15906 
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T17:26:11.000Z
CVE-2020-15907 
In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-07T19:39:08.000Z
CVE-2020-15908 
tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T03:56:37.000Z
CVE-2020-15909 
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers’ workstation by browsing to the victim’s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T12:57:26.000Z
CVE-2020-15910 
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-19T12:57:26.000Z
CVE-2020-15912 
Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T14:40:19.000Z
CVE-2020-15914 
A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data related to the target user’s Origin account, or to control or monitor the Origin text chat window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-30T16:27:18.000Z
CVE-2020-15916 
goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T17:53:48.000Z
CVE-2020-15917 
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T18:06:26.000Z
CVE-2020-15918 
Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:59:10.000Z
CVE-2020-15919 
A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:59.000Z
CVE-2020-15920 
There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:51.000Z
CVE-2020-15921 
Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:43.000Z
CVE-2020-15922 
There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:32.000Z
CVE-2020-15923 
Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:17.000Z
CVE-2020-15924 
There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T00:58:06.000Z
CVE-2020-15925 
A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via the TPF_XPAR1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T13:46:47.000Z
CVE-2020-15926 
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-18T20:50:27.000Z
CVE-2020-15927 
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-06T18:56:15.000Z
CVE-2020-15928 
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-24T01:41:01.000Z
CVE-2020-15929 
In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags, leading to Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-24T01:32:48.000Z
CVE-2020-15930 
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T18:41:38.000Z
CVE-2020-15931 
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-20T19:23:17.000Z
CVE-2020-15932 
Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-24T16:15:40.000Z
CVE-2020-15933 
A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiMail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X
version: 3.1
Published: 2022-01-05T11:29:04.000Z
CVE-2020-15934 
An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local users to elevate their privileges to root by creating a malicious script or program on the target machine.
Problem types: cwe_id: CWE-269
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiClientLinux
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X
Published: 2024-12-19T10:57:39.255Z
CVE-2020-15935 
A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiADC
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 4.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X
version: 3.1
Published: 2021-11-02T19:00:53.000Z
CVE-2020-15936 
A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: NONE
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
privilegesRequired: HIGH
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 2.6
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X
version: 3.1
Published: 2022-03-01T18:25:27.000Z
CVE-2020-15937 
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Published: 2021-03-03T15:45:56.000Z
CVE-2020-15938 
When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header.
Problem types: description: Operational Risk, Traffic Bypass
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2021-03-04T17:28:59.000Z
CVE-2020-15939 
An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.
Problem types: description: Improper Access Control
Affected products: vendor: Fortinet
product: Fortinet FortiSandbox
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 4.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X
version: 3.1
Published: 2021-09-06T15:19:38.000Z