CVE-2024-21756: OS Command Injection

Q: What is the severity of CVE-2024-21756?

CVE-2024-21756 is classified as a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2024-21756?

To fix CVE-2024-21756, you should update Fortinet FortiSandbox to the latest version that is not affected by this vulnerability.

Q: What are the affected versions in CVE-2024-21756?

CVE-2024-21756 affects Fortinet FortiSandbox versions 4.0.0 through 4.0.4, 4.2.0 through 4.2.6, and 4.4.0 through 4.4.3.

Q: What type of vulnerability is CVE-2024-21756?

CVE-2024-21756 is an OS command injection vulnerability that allows attackers to execute unauthorized commands.

Q: Who is impacted by CVE-2024-21756?

Organizations using vulnerable versions of Fortinet FortiSandbox are at risk of exploitation due to CVE-2024-21756.

Published Apr 9, 2024

Updated

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..

Affected Software

3 affected components

Fortinet FortiSandbox>=4.0.0<4.0.5

Fortinet FortiSandbox>=4.2.0<4.2.7

Fortinet FortiSandbox>=4.4.0<4.4.4

Remediation

Information

Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action. Upgrade to FortiSandbox version 4.4.4 or above Upgrade to FortiSandbox version 4.2.7 or above Upgrade to FortiSandbox version 4.0.5 or above

Event History

Apr 9, 2024

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-21756?

CVE-2024-21756 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2024-21756?