The vulnerability of the FortiSandbox threat detection and mitigation system lies in its improper handling of path name restrictions for restricted access directories. This allows attackers to delete any files they desire.

🗓️ 24 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

FortiSandbox improper path name restrictions allow attackers to delete arbitrary files via crafted web requests.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-23671	11 Apr 202410:21	–	circl
CNNVD	Fortinet FortiSandbox 路径遍历漏洞	9 Apr 202400:00	–	cnnvd
CNVD	Fortinet FortiSandbox Path Traversal Vulnerability (CNVD-2024-21266)	12 Apr 202400:00	–	cnvd
CVE	CVE-2024-23671	9 Apr 202414:24	–	cve
Cvelist	CVE-2024-23671	9 Apr 202414:24	–	cvelist
EUVD	EUVD-2024-21144	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Fortinet	10 Apr 202400:00	–	ncsc
NVD	CVE-2024-23671	9 Apr 202415:15	–	nvd
OSV	CVE-2024-23671	9 Apr 202415:15	–	osv
Positive Technologies	PT-2024-3041 · Fortinet · Fortisandbox	9 Apr 202400:00	–	ptsecurity

Vulners

Node

fortinet fortisandboxRange4.4.0–4.4.4

OR

fortinet fortisandboxRange4.2.0–4.2.7

OR

fortinet fortisandboxRange4.0.0–4.0.5

Source	Link
fortiguard	www.fortiguard.com/psirt/FG-IR-23-454
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2024040983
web	www.web.nvd.nist.gov/view/vuln/detail
fortiguard	www.fortiguard.com/psirt/FG-IR-23-454

24 Apr 2024 00:00Current

5.6Medium risk

Vulners AI Score5.6

CVSS 38.1

CVSS 28.5

EPSS0.00827

FortiSandbox vulnerability Path name restrictions Restricted directories Delete arbitrary files Crafted web requests