CVE-2024-23671
Assigner: fortinet
Published: 2024-04-09T14:24:20.543Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiSandbox
defaultStatus: unaffected
versions: versionType: semver
version: 4.4.0
lessThanOrEqual: 4.4.3
status: affected
versionType: semver
version: 4.2.0
lessThanOrEqual: 4.2.6
status: affected
versionType: semver
version: 4.0.0
lessThanOrEqual: 4.0.4
status: affected
descriptions: value: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.3 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
problemTypes: descriptions: cweId: CWE-22
description: Execute unauthorized code or commands
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:X/RC:C
solutions: value: Please upgrade to FortiSandbox version 4.4.4 or above 
Please upgrade to FortiSandbox version 4.2.7 or above 
Please upgrade to FortiSandbox version 4.0.5 or above