CVE-2024-23671: Arbitrary file delete on endpoint
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Other sources
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiSandbox may allow an authenticated attacker with at least read-only permission to delete arbitrary files via crafted HTTP requests.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23671?
CVE-2024-23671 is considered a critical vulnerability due to its potential to allow unauthorized code execution.
How do I fix CVE-2024-23671?
To fix CVE-2024-23671, upgrade Fortinet FortiSandbox to version 4.4.4 or later, 4.2.7 or later, or 4.0.5 or later depending on your current version.
What versions of Fortinet FortiSandbox are affected by CVE-2024-23671?
CVE-2024-23671 affects Fortinet FortiSandbox versions 4.4.0 through 4.4.3, 4.2.0 through 4.2.6, and 4.0.0 through 4.0.4.
Is there a known exploit for CVE-2024-23671?
Yes, CVE-2024-23671 can be exploited through crafted HTTP requests that take advantage of path traversal vulnerabilities.
Who is impacted by CVE-2024-23671?
Organizations using affected versions of Fortinet FortiSandbox are at risk of exploitation from CVE-2024-23671.