CVE-2021-24014

MEDIUM

FortiSandbox < 4.0.0 - Unauthenticated Cross-Site Scripting via Crafted Request Parameters

Title source: llm

Description

Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-20-209

Scores

CVSS v3 5.4

EPSS 0.0044

EPSS Percentile 63.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

fortinet/fortisandbox < 3.1.4

Published Aug 04, 2021

Tracked Since Feb 18, 2026