PT-2025-10781 · Forti · Fortisandbox+1
Publicado
2025-03-11
·
Atualizado
2025-03-12
·
CVE-2024-54026
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
FortiSandbox Cloud version 23.4
FortiSandbox versions 3.0.0 through 3.0.7
FortiSandbox versions 3.1.0 through 3.1.5
FortiSandbox versions 3.2.0 through 3.2.4
FortiSandbox versions 4.0.0 through 4.0.5
FortiSandbox versions 4.2.0 through 4.2.7
FortiSandbox versions 4.4.0 through 4.4.6
Description:
The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This allows an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Recommendations:
For FortiSandbox Cloud version 23.4, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.0.0 through 3.0.7, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.1.0 through 3.1.5, update to a version that includes a fix for this issue.
For FortiSandbox versions 3.2.0 through 3.2.4, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.0.0 through 4.0.5, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.2.0 through 4.2.7, update to a version that includes a fix for this issue.
For FortiSandbox versions 4.4.0 through 4.4.6, update to a version that includes a fix for this issue.
As a temporary workaround, consider restricting access to the SQL command functionality until a patch is available.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fortisandbox
Fortisandbox Cloud