PT-2023-6010 · Fortinet · Fortisandbox

Published 2023-10-13 · Updated 2023-10-16 · CVE-2023-41682

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 2.4.0 through 2.5.2 FortiSandbox versions 3.2.0 through 3.2.4 FortiSandbox versions 4.0.0 through 4.0.3 FortiSandbox versions 4.2.0 through 4.2.5 FortiSandbox version 4.4.0

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', in FortiSandbox. This can be exploited by a remote attacker to cause a denial of service via crafted HTTP requests.

Recommendations For FortiSandbox versions 2.4.0 through 2.5.2, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 3.2.0 through 3.2.4, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 4.0.0 through 4.0.3, update to a version that fixes the 'path traversal' issue. For FortiSandbox versions 4.2.0 through 4.2.5, update to a version that fixes the 'path traversal' issue. For FortiSandbox version 4.4.0, update to a version that fixes the 'path traversal' issue. As a temporary workaround, consider restricting access to crafted HTTP requests that may exploit the 'path traversal' issue until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-06711

CVE-2023-41682

Affected Products

Fortisandbox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-41682 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41682 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-280 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06711 · Security Note
• https://t.me/cibsecurity/72252 · Telegram Post