description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 may allows attacker to information disclosure via crafted http requests.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiSandbox
defaultStatus: unaffected
versions:
versionType: semver, version: 4.4.0, lessThanOrEqual: 4.4.4, status: affected
versionType: semver, version: 4.2.0, lessThanOrEqual: 4.2.6, status: affected
versionType: semver, version: 4.0.0, lessThanOrEqual: 4.0.5, status: affected
versionType: semver, version: 3.2.0, lessThanOrEqual: 3.2.4, status: affected
versionType: semver, version: 3.1.0, lessThanOrEqual: 3.1.5, status: affected
versionType: semver, version: 3.0.0, lessThanOrEqual: 3.0.7, status: affected
versionType: semver, version: 2.5.0, lessThanOrEqual: 2.5.2, status: affected
versionType: semver, version: 2.4.0, lessThanOrEqual: 2.4.1, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N/E:F/RL:X/RC:X
]
solutions: Please upgrade to FortiSandbox version 4.4.5 or above
Please upgrade to FortiSandbox version 4.2.7 or above