description: An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2  may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiSandbox
defaultStatus: unaffected
versions:
versionType: semver, version: 4.0.0, lessThanOrEqual: 4.0.2, status: affected
versionType: semver, version: 3.2.0, lessThanOrEqual: 3.2.3, status: affected
versionType: semver, version: 3.1.0, lessThanOrEqual: 3.1.5, status: affected
}
{
vendor: Fortinet
product: FortiDeceptor
defaultStatus: unaffected
versions:
version: 4.2.0, status: affected
versionType: semver, version: 4.1.0, lessThanOrEqual: 4.1.1, status: affected
versionType: semver, version: 4.0.0, lessThanOrEqual: 4.0.2, status: affected
versionType: semver, version: 3.3.0, lessThanOrEqual: 3.3.3, status: affected
versionType: semver, version: 3.2.0, lessThanOrEqual: 3.2.2, status: affected
versionType: semver, version: 3.1.0, lessThanOrEqual: 3.1.1, status: affected
versionType: semver, version: 3.0.0, lessThanOrEqual: 3.0.2, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:C
]
solutions: Please upgrade to FortiSandbox version 4.2.1 or above
Please upgrade to FortiDeceptor version 4.3.0 or above