CVE-2022-27485: SQL Injection
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-27485?
CVE-2022-27485 is a vulnerability that allows a remote and authenticated attacker to perform SQL injection in Fortinet FortiSandbox.
What is the severity of CVE-2022-27485?
The severity of CVE-2022-27485 is medium, with a CVSS score of 6.5.
Which software versions are affected by CVE-2022-27485?
Fortinet FortiSandbox versions 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x, and 3.0.x are affected by CVE-2022-27485.
How does CVE-2022-27485 impact Fortinet FortiSandbox?
CVE-2022-27485 allows a remote and authenticated attacker with read permission to retrieve arbitrary files through SQL injection in Fortinet FortiSandbox.
Is there a fix available for CVE-2022-27485?
Yes, a fix for CVE-2022-27485 is available. It is recommended to update Fortinet FortiSandbox to a patched version to mitigate this vulnerability.