Description
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.5 through 3.0.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiSandbox | 4.4.0 – ≤ 4.4.4, 4.2.1 – ≤ 4.2.6, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.4, 3.1.0 – ≤ 3.1.5, 3.0.5 – ≤ 3.0.7 | — |
Advisories 2
- NCSC-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2025-0080 Fortinet FortiSandbox: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 14, 2025