CVE-2022-27485 — SQL Injection in Fortinet Fortisandbox

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortisandbox
Timeline
PublishedApr 11
Latest updateJul 6

Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDfortinet/fortisandbox3.1.0 — 3.2.4+3
▶CVEListV5fortinet/fortisandbox4.0.0 — 4.0.2+4

🔴Vulnerability Details

2
GHSA
GHSA-2vhr-q545-p6f9: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4↗2023-07-06
▶
CVEList
CVE-2022-27485: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4↗2023-04-11
▶

📋Vendor Advisories

1
Fortinet
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortine...↗2023-04-11
▶
CVE-2022-27485 — SQL Injection in Fortinet Fortisandbox | cvebase