PT-2023-7752 · Fortinet · Fortisandbox

Published 2023-12-12 · Updated 2023-12-15 · CVE-2023-45587

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 3.1.0 through 3.1.5 FortiSandbox versions 3.2.0 through 3.2.4 FortiSandbox versions 4.0.0 through 4.0.3 FortiSandbox versions 4.2.0 through 4.2.5 FortiSandbox version 4.4.0 FortiSandbox version 4.4.1

Description The issue is related to the improper neutralization of input during web page generation, which can lead to cross-site scripting attacks. This allows a remote attacker to execute unauthorized code or commands via crafted HTTP requests.

Recommendations For FortiSandbox versions 3.1.0 through 3.1.5, update to a version that includes the fix for this issue. For FortiSandbox versions 3.2.0 through 3.2.4, update to a version that includes the fix for this issue. For FortiSandbox versions 4.0.0 through 4.0.3, update to a version that includes the fix for this issue. For FortiSandbox versions 4.2.0 through 4.2.5, update to a version that includes the fix for this issue. For FortiSandbox version 4.4.0, update to a version that includes the fix for this issue. For FortiSandbox version 4.4.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the web interface of FortiSandbox to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08819

CVE-2023-45587

Affected Products

Fortisandbox

References · 7

• https://osv.dev/vulnerability/CVE-2023-45587 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45587 · Security Note
• https://bdu.fstec.ru/vul/2023-08819 · Security Note
• https://twitter.com/CVEnew/status/1734828599444742471 · Twitter Post
• https://t.me/cvenotify/63448 · Telegram Post
• https://t.me/cvenotify/63820 · Telegram Post