CVE-2024-23671 | FortiSandbox - Web Interface Operational Intel

Executive Risk Summary

"A path traversal vulnerability in Fortinet FortiSandbox allows attackers to execute unauthorized code or commands via crafted HTTP requests, potentially leading to system compromise. This vulnerability affects FortiSandbox versions 4.4.0 through 4.4.3, 4.2.1 through 4.2.6, and 4.0.0 through 4.0.4."

Operational Audit Arsenal

Target Type Firmware Image

Target Asset FortiSandbox Firmware

Standard Path Global Firmware

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

FortiSandbox path traversal vulnerability (CVE-2024-23671) - verify version and apply patch if necessary, using CLI command 'get system status' to check version

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.com/psirt/FG-IR-23-454

Scope of Impact

Fortinet Fortisandbox

Original NVD Description

"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-34992 CVSS 10

FortiGate - API

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.