CVE-2024-52960
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least re
Severity
Medium 4.2
CVSS 3.1
Exploited
Not listed
EPSS
0.003
26.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Mar 11, 2025
Assigned by fortinet
Description
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
Weakness: CWE-602
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiSandbox
Credit
Internally discovered and reported by Adham El karn of Fortinet Product Security team.
Vendor remediation
Upgrade to FortiSandbox version 5.0.1 or above Upgrade to FortiSandbox version 4.4.7 or above Upgrade to FortiSandbox version 4.2.8 or above