CVE-2024-52960

A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.

Score

CVSS 3.1 8.8 High

Status

Analyzed - psirt@fortinet.com

Published

2025-03-11

Last modified

2026-01-14

Weaknesses

CWE-602

Affected products

• Fortisandbox (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-24-305