Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2022-27485

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 thr

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiSandbox

Default version status: unaffected

  • 4.2.0affected
  • 4.0.0 to ≤ 4.0.2affected
  • 3.2.0 to ≤ 3.2.3affected
  • 3.1.0 to ≤ 3.1.5affected
  • 3.0.1 to ≤ 3.0.7affected

References