FG-IR-25-093: XSS via back button
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox may allow an unauthenticated attacker to execute commands via crafted requests. FortiSandbox PaaS versions 4.4.8 and 5.0.5 contains the fix for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-25-093?
The FG-IR-25-093 vulnerability is classified as a critical severity due to the potential for unauthenticated command execution.
How do I fix FG-IR-25-093?
To remediate FG-IR-25-093, upgrade to FortiSandbox version 4.4.8 or 5.0.5 as these contain the necessary patches.
Which versions of FortiSandbox are affected by FG-IR-25-093?
FortiSandbox versions 4.4.0 to 4.4.7 and 5.0.0 to 5.0.1 are affected by FG-IR-25-093.
Can FG-IR-25-093 be exploited remotely?
Yes, FG-IR-25-093 can be exploited remotely by an unauthenticated attacker under certain conditions.
What kind of attacks can FG-IR-25-093 enable?
FG-IR-25-093 enables Cross-site Scripting (XSS) attacks, which can allow execution of arbitrary commands.