CVE-2023-41844: XSS
First published: Wed Dec 13 2023(Updated: )
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests in capture traffic endpoint.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiSandbox | >=3.0.0<=3.0.7 | |
| Fortinet FortiSandbox | >=3.1.0<=3.1.5 | |
| Fortinet FortiSandbox | >=3.2.0<=3.2.4 | |
| Fortinet FortiSandbox | >=4.0.0<=4.0.4 | |
| Fortinet FortiSandbox | >=4.2.0<=4.2.5 | |
| Fortinet FortiSandbox | =4.4.0 | |
| Fortinet FortiSandbox | =4.4.1 | |
| Fortinet FortiSandbox | =4.4.2 |
Remedy
Please upgrade to FortiSandbox version 4.4.3 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-41844?
CVE-2023-41844 is classified as a high severity vulnerability due to its potential for allowing cross-site scripting attacks.
How can I fix CVE-2023-41844?
To mitigate CVE-2023-41844, update Fortinet FortiSandbox to version 4.4.2 or later.
Who is affected by CVE-2023-41844?
CVE-2023-41844 affects Fortinet FortiSandbox versions 3.0.0 through 4.4.1.
What type of attack is possible with CVE-2023-41844?
CVE-2023-41844 allows for cross-site scripting (XSS) attacks, enabling unauthorized code execution on affected systems.
When was CVE-2023-41844 disclosed?
CVE-2023-41844 was publicly disclosed in 2023.
- collector/nvd-api
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/fortinet
- canonical/fortinet fortisandbox
- version/fortinet fortisandbox/3.0.0
- version/fortinet fortisandbox/3.0.7
- version/fortinet fortisandbox/3.1.0
- version/fortinet fortisandbox/3.1.5
- version/fortinet fortisandbox/3.2.0
- version/fortinet fortisandbox/3.2.4
- version/fortinet fortisandbox/4.0.0
- version/fortinet fortisandbox/4.0.4
- version/fortinet fortisandbox/4.2.0
- version/fortinet fortisandbox/4.2.5
- version/fortinet fortisandbox/4.4.0
- version/fortinet fortisandbox/4.4.1
- version/fortinet fortisandbox/4.4.2