PT-2019-6213 · Fortinet · Fortisandbox

Published 2019-04-03 · Updated 2019-05-02 · CVE-2018-1356

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 3.0

Description A reflected Cross-Site-Scripting (XSS) issue exists due to insufficient protection of the web page structure in the file scan component. This may allow an attacker to execute unauthorized code or commands via the back url parameter.

Recommendations For versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the back url parameter in the file scan component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-03216

CVE-2018-1356

Affected Products

Fortisandbox

References · 5

• https://fortiguard.com/advisory/FG-IR-18-024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03216 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1356 · Security Note
• http://securityfocus.com/bid/107838 · Note