Lucene search

[email protected]CVE-2023-41682

HistoryOct 13, 2023 - 3:15 p.m.

CVE-2023-41682

2023-10-1315:15:44

CWE-22

[email protected]

web.nvd.nist.gov

cve-2023-41682

fortinet

fortisandbox

path traversal

vulnerability

denial of service

http requests

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RC:C

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.3%

JSON

A improper limitation of a pathname to a restricted directory (‘path traversal’) in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests.

Affected configurations

NVD

Node

fortinetfortisandboxRange2.4.0–2.4.1

fortinetfortisandboxRange2.5.0–2.5.2

fortinetfortisandboxRange3.2.0–3.2.4

fortinetfortisandboxRange4.0.0–4.0.3

fortinetfortisandboxRange4.2.0–4.2.5

fortinetfortisandboxMatch4.4.0

CPENameOperatorVersion
fortinet:fortisandboxfortinet fortisandboxle2.4.1
fortinet:fortisandboxfortinet fortisandboxle2.5.2
fortinet:fortisandboxfortinet fortisandboxle3.2.4
fortinet:fortisandboxfortinet fortisandboxle4.0.3
fortinet:fortisandboxfortinet fortisandboxle4.2.5
fortinet:fortisandboxfortinet fortisandboxeq4.4.0

CPE	Name	Operator	Version
fortinet:fortisandbox	fortinet fortisandbox	le	2.4.1
fortinet:fortisandbox	fortinet fortisandbox	le	2.5.2
fortinet:fortisandbox	fortinet fortisandbox	le	3.2.4
fortinet:fortisandbox	fortinet fortisandbox	le	4.0.3
fortinet:fortisandbox	fortinet fortisandbox	le	4.2.5
fortinet:fortisandbox	fortinet fortisandbox	eq	4.4.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiSandbox",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "4.4.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.2.0",
        "lessThanOrEqual": "4.2.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "4.0.0",
        "lessThanOrEqual": "4.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.2.0",
        "lessThanOrEqual": "3.2.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.1.0",
        "lessThanOrEqual": "3.1.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "3.0.0",
        "lessThanOrEqual": "3.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.5.0",
        "lessThanOrEqual": "2.5.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.4.0",
        "lessThanOrEqual": "2.4.1",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-23-280

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RC:C

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.3%

JSON

Related for CVE-2023-41682

prion1 cvelist1 nvd1