CVE-2022-27485

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-274867.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5 CVE-2022-274878.8A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor CVE-2022-274888.8A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 th CVE-2022-274897.2A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, CVE-2022-27498.8A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an un CVE-2022-274906.5A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0 CVE-2022-274917.5A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through CVE-2022-274927.8An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.CVE-2022-274937.8Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially e CVE-2022-274945.4Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-274956.5On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software CVE-2022-274966.1Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via un