FortiSandbox / FortiDeceptor - Improper profile-based access control over APIs

2023-04-1100:00:00

FortiGuard Labs

www.fortiguard.com

fortisandbox

fortideceptor

vulnerability

api access control

http requests

https requests

0.002 Low

EPSS

Percentile

55.1%

JSON

An improper privilege management vulnerability [CWE-269] in FortiSandbox & FortiDeceptor may allow a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.

CPENameOperatorVersion
fortideceptoreq4.1.0
fortideceptoreq4.0.2
fortideceptoreq4.0.1
fortideceptoreq4.0.0
fortideceptoreq3.3.3
fortideceptoreq3.3.2
fortideceptoreq3.3.1
fortideceptoreq3.3.0
fortideceptoreq3.2.2
fortideceptoreq3.2.1

Name	Operator	Version
fortideceptor	eq	4.1.0
fortideceptor	eq	4.0.2
fortideceptor	eq	4.0.1
fortideceptor	eq	4.0.0
fortideceptor	eq	3.3.3
fortideceptor	eq	3.3.2
fortideceptor	eq	3.3.1
fortideceptor	eq	3.3.0
fortideceptor	eq	3.2.2
fortideceptor	eq	3.2.1

Rows per page:

1-10 of 481

0.002 Low

EPSS

Percentile

55.1%

JSON

Related for FG-IR-22-056