PT-2021-7554 · Fortinet · Fortisandbox

Published 2021-08-03 · Updated 2021-08-11 · CVE-2021-24010

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.1.0 through 3.1.4 FortiSandbox versions 3.2.0 through 3.2.2

Description The issue is related to improper limitation of a pathname to a restricted directory in FortiSandbox. This can be exploited by a remote attacker using a specially crafted request to gain unauthorized access to protected information. An authenticated user may obtain unauthorized access to files and data via specifically crafted web requests.

Recommendations For FortiSandbox versions 3.1.0 through 3.1.4, update to a version outside of this range to resolve the issue. For FortiSandbox versions 3.2.0 through 3.2.2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-07532

CVE-2021-24010

Affected Products

Fortisandbox

References · 5

• https://fortiguard.com/advisory/FG-IR-20-202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-24010 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24010 · Vendor Advisory
• https://t.me/cibsecurity/26810 · Telegram Post