CVE-2023-45587 - An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions allows attacker to execute unauthorized code or commands via crafted HTTP requests

Back Back to CVE browser

MEDIUM

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions allows attacker to execute unauthorized code or commands via crafted HTTP requests

Published Dec 13, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.43%

Description

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions allows attacker to execute unauthorized code or commands via crafted HTTP requests

Affected products

Vendor Fortinet Product FortiSandbox Default
unaffected
- Version
  3.1.0
  Status
  affected
  Constraints
  <=3.1.5
- Version
  3.2.0
  Status
  affected
  Constraints
  <=3.2.4
- Version
  4.0.0
  Status
  affected
  Constraints
  <=4.0.6
- Version
  4.2.1
  Status
  affected
  Constraints
  <=4.2.8
- Version
  4.4.0
  Status
  affected
  Constraints
  <=4.4.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

FortiSandbox

unaffected

Version	Status	Constraints
3.1.0	affected	<=3.1.5
3.2.0	affected	<=3.2.4
4.0.0	affected	<=4.0.6
4.2.1	affected	<=4.2.8
4.4.0	affected	<=4.4.2

Remediation

Vendor solution

Upgrade to FortiSandbox version 4.4.3 or above Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)