PT-2023-6010 · Fortinet · Fortisandbox

CVE-2023-41682 · Publicado 2023-10-13 · Atualizado 2023-10-16

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 2.4.0 through 2.5.2 FortiSandbox versions 3.2.0 through 3.2.4 FortiSandbox versions 4.0.0 through 4.0.3 FortiSandbox versions 4.2.0 through 4.2.5 FortiSandbox version 4.4.0

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', in FortiSandbox. This can be exploited by a remote attacker to cause a denial of service via crafted HTTP requests.

Recommendations For FortiSandbox versions 2.4.0 through 2.5.2, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 3.2.0 through 3.2.4, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 4.0.0 through 4.0.3, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 4.2.0 through 4.2.5, update to a version that fixes the 'path traversal' issue. For FortiSandbox version 4.4.0, update to a version that fixes the 'path traversal' issue. As a temporary workaround, consider restricting access to crafted HTTP requests that may exploit the 'path traversal' issue until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-06711

CVE-2023-41682

Produtos afetados

Fortisandbox

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-41682 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-41682 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-23-280 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06711 · Nota de Segurança
• https://t.me/cibsecurity/72252 · Publicação no Telegram