CVE-2023-47541
published 2024-04-09CVE-2023-47541: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox…
PriorityP434medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.29%
20.5th percentile
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions, FortiSandbox 2.2 all versions, FortiSandbox 2.1 all versions, FortiSandbox 2.0 all versions allows attacker to execute unauthorized code or commands via CLI.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | >= 2.0.0 < 4.2.7 | 4.2.7 |
| fortinet | fortisandbox | 2.0.0 – 2.0.3 | — |
| fortinet | fortisandbox | 2.1.0 – 2.1.3 | — |
| fortinet | fortisandbox | 2.2.0 – 2.2.2 | — |
| fortinet | fortisandbox | 2.3.0 – 2.3.3 | — |
| fortinet | fortisandbox | 2.4.0 – 2.4.1 | — |
| fortinet | fortisandbox | 2.5.0 – 2.5.2 | — |
| fortinet | fortisandbox | 3.0.0 – 3.0.7 | — |
| fortinet | fortisandbox | 3.1.0 – 3.1.5 | — |
| fortinet | fortisandbox | 3.2.0 – 3.2.4 | — |
| fortinet | fortisandbox | 4.0.0 – 4.0.6 | — |
| fortinet | fortisandbox | 4.2.1 – 4.2.6 | — |
| fortinet | fortisandbox | >= 4.4.0 < 4.4.3 | 4.4.3 |
| fortinet | fortisandbox | 4.4.0 – 4.4.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution
vendor_fortinet·2024-04-09·CVSS 6.7
CVE-2023-47541 [MEDIUM] CWE-22 FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution
FG-IR-23-416: FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions, FortiSandbox 2.2 all versions, FortiSandbox 2.1 all versions, FortiSandbox 2.0 all versions allows attacker to execute unauthorized code or commands via CLI.
CVEs: CVE-2023-47541
CWEs: CWE-22
CVSS: 6.7 (medium)
Affected products: FortiSandbox, Fortinet
GHSA
GHSA-cfhh-2gpx-32wx: An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4
ghsa_unreviewed·2024-04-09
CVE-2023-47541 [MEDIUM] CWE-22 GHSA-cfhh-2gpx-32wx: An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4
An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-09
Published