CVE-2021-22125: Command Injection in FSA sniffer module
An instance of improper neutralization of special elements in FortiSandbox's sniffer module may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
Other sources
An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this FortiSandbox vulnerability?
The vulnerability ID is CVE-2021-22125.
What is the title of this FortiSandbox vulnerability?
The title of this vulnerability is 'An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.'
What is the severity of CVE-2021-22125?
The severity of CVE-2021-22125 is critical with a CVSS score of 7.2.
Which software versions are affected by CVE-2021-22125?
FortiSandbox versions up to and excluding 3.2.2 are affected by this vulnerability.
How can an authenticated administrator exploit this vulnerability?
By altering the content of the configuration file in the sniffer module of FortiSandbox, an authenticated administrator can execute commands on the underlying system's shell.