PT-2024-3289 · Fortinet · Fortisandbox

Published

2024-04-09

·

Updated

2024-12-23

·

CVE-2023-47540

CVSS v3.1

6.7

Medium

VectorAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 3.0.5 through 3.0.7 Fortinet FortiSandbox versions 3.2.0 through 3.2.4 Fortinet FortiSandbox versions 4.0.0 through 4.0.5 Fortinet FortiSandbox versions 4.2.0 through 4.2.6 Fortinet FortiSandbox versions 4.4.0 through 4.4.2
Description The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection', which may allow an attacker to execute unauthorized code or commands via CLI. This can be achieved by sending specially crafted requests to the CLI.
Recommendations For Fortinet FortiSandbox versions 3.0.5 through 3.0.7, update to a version that includes a fix for this issue. For Fortinet FortiSandbox versions 3.2.0 through 3.2.4, update to a version that includes a fix for this issue. For Fortinet FortiSandbox versions 4.0.0 through 4.0.5, update to a version that includes a fix for this issue. For Fortinet FortiSandbox versions 4.2.0 through 4.2.6, update to a version that includes a fix for this issue. For Fortinet FortiSandbox versions 4.4.0 through 4.4.2, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-03521
CVE-2023-47540

Affected Products

Fortisandbox