Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-27485

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

Published

2023-04-11T17:15:07.130

Last Modified

2024-11-21T06:55:49.123

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-89
  • Type: Primary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fortinet fortisandbox ≤ 3.0.7 Yes
Application fortinet fortisandbox < 3.2.4 Yes
Application fortinet fortisandbox < 4.0.3 Yes
Application fortinet fortisandbox 4.2.0 Yes
References