- Description
- A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.3 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
- Source
- psirt@fortinet.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Severity
- HIGH
- psirt@fortinet.com
- CWE-22
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86397C25-3189-4C22-8D2D-C88BC9569127",
"versionEndExcluding": "4.0.5",
"versionStartIncluding": "4.0.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "958CF981-06BE-44FF-B5CF-156649D86232",
"versionEndExcluding": "4.2.7",
"versionStartIncluding": "4.2.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A2DF9F8-E286-4404-93A0-D80C99DD48A8",
"versionEndExcluding": "4.4.4",
"versionStartIncluding": "4.4.0"
}
],
"operator": "OR"
}
]
}
]