Fortinet: >> Fortisandbox >> 3.0.2 Security Vulnerabilities
An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score
8.8
EPSS Score
0.007
Published
2021-08-04
An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs.
CVSS Score
5.3
EPSS Score
0.003
Published
2021-08-04
An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
CVSS Score
6.3
EPSS Score
0.003
Published
2021-07-20
A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.
CVSS Score
6.3
EPSS Score
0.005
Published
2021-07-09
Page 3