Описание
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.1 High
CVSS3
9 Critical
CVSS3
Дефекты
Связанные уязвимости
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox at least versions 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Уязвимость графического интерфейса пользователя системы выявления и устранения угроз FortiSandbox, позволяющая нарушителю выполнить межсайтовые сценарные атаки
EPSS
7.1 High
CVSS3
9 Critical
CVSS3