Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiSandbox | unaffected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortisandbox | — |
Vendor Solution
Fortinet remediated this issue in FortiSandbox Cloud version 24.2 (not released) and hence customers do not need to perform any action. Upgrade to FortiSandbox version 5.0.1 or above Upgrade to FortiSandbox version 4.4.7 or above Upgrade to FortiSandbox version 4.2.8 or above Upgrade to FortiSandbox version 4.0.6 or above
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2024-54238 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.7, 4.2.0 through 4.2.7 and before 4.0.5 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.548% probability within 30 days)
| Link | Providers |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-24-306 |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.7, 4.2.0 through 4.2.7 and before 4.0.5 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. |
| CPEs | cpe:2.3:a:fortinet:fortisandbox:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.1.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.7, 4.2.0 through 4.2.7 and before 4.0.5 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_1
|