CVE-2023-41836
Assigner: fortinet
Published: 2023-10-13T14:51:22.277Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiSandbox
defaultStatus: unaffected
versions: version: 4.4.0
status: affected
versionType: semver
version: 4.2.0
lessThanOrEqual: 4.2.4
status: affected
versionType: semver
version: 4.0.0
lessThanOrEqual: 4.0.4
status: affected
versionType: semver
version: 3.2.0
lessThanOrEqual: 3.2.4
status: affected
versionType: semver
version: 3.1.0
lessThanOrEqual: 3.1.5
status: affected
versionType: semver
version: 3.0.4
lessThanOrEqual: 3.0.7
status: affected
descriptions: value: An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.4, and 4.0.0 through 4.0.4 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
problemTypes: descriptions: cweId: CWE-79
description: Execute unauthorized code or commands
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:C
solutions: value: Please upgrade to FortiSandbox version 4.4.2 or above