Paper/Archive/CVE-2024-27781

CVE-2024-27781

Fortinet FortiSandbox — An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 thro…

EPSS 28%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 98.1.981 × 2019.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiSandbox4.4.0 – 4.4.4–CNA

FortiSandbox4.2.1 – 4.2.6–CNA

FortiSandbox4.0.0 – 4.0.4–CNA

FortiSandbox3.2.0 – 3.2.4–CNA

FortiSandbox3.1.0 – 3.1.5–CNA

FortiSandbox3.0.0 – 3.0.7–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

fortinet (CNA)6.9CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-24-063