CyberCVE

CVE-2024-54026

An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, Fort

Severity
Medium 4.1
CVSS 3.1
Exploited
Not listed
EPSS
0.004
31.3th percentile
Discovered by
Not disclosed
Published
Mar 11, 2025
Assigned by fortinet

Description

An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiSandbox Threat Detection & Sandbox cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiSandbox
  • Fortinet · FortiSandbox Cloud

Vendor remediation

Upgrade to FortiSandbox version 5.0.1 or above Upgrade to FortiSandbox version 4.4.7 or above Fortinet remediated this issue in FortiSandbox Cloud version 24.2 (not released) and hence customers do not need to perform any action.

References