CVE-2024-21755: OS Command Injection

Q: What is the severity of CVE-2024-21755?

CVE-2024-21755 has a critical severity rating due to its potential for unauthorized code execution.

Q: How do I fix CVE-2024-21755?

To fix CVE-2024-21755, upgrade Fortinet FortiSandbox to a version later than 4.4.4, 4.2.7, or 4.0.5.

Q: What versions of Fortinet FortiSandbox are affected by CVE-2024-21755?

CVE-2024-21755 affects FortiSandbox versions 4.0.0 through 4.0.4, 4.2.0 through 4.2.6, and 4.4.0 through 4.4.3.

Q: What type of vulnerability is CVE-2024-21755?

CVE-2024-21755 is an OS command injection vulnerability allowing an attacker to execute unauthorized commands.

Q: How can an attacker exploit CVE-2024-21755?

An attacker can exploit CVE-2024-21755 by sending crafted requests to the vulnerable FortiSandbox versions.

Published Apr 9, 2024

Updated

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..

Affected Software

3 affected components

Fortinet FortiSandbox>=4.0.0<4.0.5

Fortinet FortiSandbox>=4.2.0<4.2.7

Fortinet FortiSandbox>=4.4.0<4.4.4

Remediation

Information

Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action. Upgrade to FortiSandbox version 4.4.4 or above Upgrade to FortiSandbox version 4.2.7 or above Upgrade to FortiSandbox version 4.0.5 or above

Event History

Apr 9, 2024

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-21755?

CVE-2024-21755 has a critical severity rating due to its potential for unauthorized code execution.

How do I fix CVE-2024-21755?