FG-IR-24-060: Arbitrary file read on endpoint
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability |CWE-22] in FortiSandbox may allow an authenticated attacker with at least read-only permission to read arbitrary files via crafted http requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-060?
The severity of FG-IR-24-060 is classified as important due to the potential for unauthorized file access.
How do I fix FG-IR-24-060?
To fix FG-IR-24-060, upgrade FortiSandbox to version 4.4.5 or later, or to 4.2.7 or later depending on your current version.
Who is affected by FG-IR-24-060?
FG-IR-24-060 affects all versions of FortiSandbox from 4.4.0 to 4.4.4 and 4.2.0 to 4.2.6, as well as older unsupported versions.
Can FG-IR-24-060 be exploited remotely?
Yes, FG-IR-24-060 can be exploited remotely by an authenticated attacker with read-only permissions.
What type of vulnerability is FG-IR-24-060?
FG-IR-24-060 is a Path Traversal vulnerability that allows unauthorized file access through crafted HTTP requests.