CVE-2023-41836

LOW

FortiSandbox 3.0.4-3.0.7, 3.1, 3.2, 4.0, 4.2.1-4.2.4, 4.4.0 - Cross-Site Scripting via Crafted HTTP Requests

Title source: llm

Description

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.

References (1)

Core 1

Core References

Patch, Third Party Advisory

https://fortiguard.com/psirt/FG-IR-23-215

Scores

CVSS v3 3.5

EPSS 0.0009

EPSS Percentile 26.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

fortinet/fortisandbox 4.4.0

fortinet/fortisandbox 3.0.4 - 3.0.7

Published Oct 13, 2023

Tracked Since Feb 18, 2026