Description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions allows attacker to denial of service via crafted http requests.
Published: 2023-10-13
Score: 7.9 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Fortinet remediated this issue in FortiSandbox Cloud version 24.1 and hence customers do not need to perform any action. Upgrade to FortiSandbox version 4.4.2 or above Upgrade to FortiSandbox version 4.2.6 or above Upgrade to FortiSandbox version 4.0.4 or above

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-46174 A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests.
References
Link Providers
https://fortiguard.com/psirt/FG-IR-23-280 cve-icon cve-icon
History

Wed, 14 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Jan 2026 14:00:00 +0000

Type Values Removed Values Added
Description A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests. A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions allows attacker to denial of service via crafted http requests.
CPEs cpe:2.3:a:fortinet:fortisandbox:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*

Subscriptions

Fortinet Fortisandbox
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-01-14T13:46:51.202Z

Reserved: 2023-08-30T13:42:39.547Z

Link: CVE-2023-41682

cve-icon Vulnrichment

Updated: 2024-08-02T19:01:35.465Z

cve-icon NVD

Status : Modified

Published: 2023-10-13T15:15:44.123

Modified: 2026-01-14T14:16:08.510

Link: CVE-2023-41682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses