PT-2021-7464 · Fortinet · Fortisandbox

Published 2021-08-03 · Updated 2021-08-10 · CVE-2020-29011

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.1.0 through 3.1.4 FortiSandbox versions 3.2.0 through 3.2.2

Description The issue is related to a lack of protection against SQL query structure attacks in the MTA adapter module for email message checking and the checksum search module of FortiSandbox. This may allow a remote attacker to execute arbitrary SQL code by sending specially crafted HTTP requests. The vulnerability can be exploited by an authenticated attacker to execute unauthorized code on the underlying SQL interpreter.

Recommendations For FortiSandbox versions 3.1.0 through 3.1.4, consider disabling the checksum search and MTA-quarantine modules until a patch is available. For FortiSandbox versions 3.2.0 through 3.2.2, consider disabling the checksum search and MTA-quarantine modules until a patch is available. As a temporary workaround, restrict access to the vulnerable modules to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-06514

CVE-2020-29011

Affected Products

Fortisandbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-29011 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-171 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06514 · Security Note
• https://t.me/cvenotify/18649 · Telegram Post
• https://t.me/cibsecurity/26837 · Telegram Post