Sign-up

ID

VAR-202108-0209


CVE

CVE-2020-29011


TITLE

FortiSandbox  In  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-011887

DESCRIPTION

Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated attacker to execute unauthorized code on the underlying SQL interpreter via specifically crafted HTTP requests. FortiSandbox for, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.34

sources: NVD: CVE-2020-29011 // JVNDB: JVNDB-2021-011887 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-375138 // VULMON: CVE-2020-29011

AFFECTED PRODUCTS

vendor:fortinetmodel:fortisandboxscope:gteversion:3.2.0

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:ltversion:3.2.2

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:ltversion:3.1.5

Trust: 1.0

vendor:フォーティネットmodel:fortisandboxscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortisandboxscope:eqversion:3.1.0 to 3.1.4

Trust: 0.8

vendor:フォーティネットmodel:fortisandboxscope:eqversion:3.2.0 to 3.2.2

Trust: 0.8

sources: JVNDB: JVNDB-2021-011887 // NVD: CVE-2020-29011

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-29011
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2020-29011
value: HIGH

Trust: 1.0

NVD: CVE-2020-29011
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202108-299
value: HIGH

Trust: 0.6

VULHUB: VHN-375138
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-29011
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-29011
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-375138
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-29011
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2021-011887
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-375138 // VULMON: CVE-2020-29011 // JVNDB: JVNDB-2021-011887 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-299 // NVD: CVE-2020-29011 // NVD: CVE-2020-29011

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-375138 // JVNDB: JVNDB-2021-011887 // NVD: CVE-2020-29011

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-299

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:FG-IR-20-171url:https://www.fortiguard.com/psirt/FG-IR-20-171

Trust: 0.8

title:Fortinet FortiSandbox SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=158551

Trust: 0.6

sources: JVNDB: JVNDB-2021-011887 // CNNVD: CNNVD-202108-299

EXTERNAL IDS

db:NVDid:CVE-2020-29011

Trust: 3.4

db:JVNDBid:JVNDB-2021-011887

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021080315

Trust: 0.6

db:AUSCERTid:ESB-2021.2616

Trust: 0.6

db:CNNVDid:CNNVD-202108-299

Trust: 0.6

db:VULHUBid:VHN-375138

Trust: 0.1

db:VULMONid:CVE-2020-29011

Trust: 0.1

sources: VULHUB: VHN-375138 // VULMON: CVE-2020-29011 // JVNDB: JVNDB-2021-011887 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-299 // NVD: CVE-2020-29011

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-20-171

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-29011

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021080315

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2616

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/89.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-375138 // VULMON: CVE-2020-29011 // JVNDB: JVNDB-2021-011887 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202108-299 // NVD: CVE-2020-29011

SOURCES

db:VULHUBid:VHN-375138
db:VULMONid:CVE-2020-29011
db:JVNDBid:JVNDB-2021-011887
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202108-299
db:NVDid:CVE-2020-29011

LAST UPDATE DATE

2024-08-14T12:17:15.968000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-375138date:2021-08-10T00:00:00
db:VULMONid:CVE-2020-29011date:2021-08-10T00:00:00
db:JVNDBid:JVNDB-2021-011887date:2022-08-16T01:47:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202108-299date:2021-08-11T00:00:00
db:NVDid:CVE-2020-29011date:2021-08-10T23:38:07.610

SOURCES RELEASE DATE

db:VULHUBid:VHN-375138date:2021-08-04T00:00:00
db:VULMONid:CVE-2020-29011date:2021-08-04T00:00:00
db:JVNDBid:JVNDB-2021-011887date:2022-08-16T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202108-299date:2021-08-03T00:00:00
db:NVDid:CVE-2020-29011date:2021-08-04T16:15:08.073