CVE-2025-54353

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-477	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortisandbox::::::::
	cpe:2.3:a:fortinet:fortisandbox::::::::
	cpe:2.3:a:fortinet:fortisandbox::::::::
	cpe:2.3:a:fortinet:fortisandbox::::::::

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Neutralización Inadecuada de Entrada Durante la Generación de Páginas Web ('cross-site scripting') [CWE-79] vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.2, FortiSandbox 4.4.0 hasta 4.4.7, FortiSandbox 4.2 todas las versiones, FortiSandbox 4.0 todas las versiones puede permitir a un atacante realizar un ataque XSS mediante solicitudes HTTP manipuladas.

Information

Published : 2025-12-09 18:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-54353

Mitre link : CVE-2025-54353

CVE.ORG link : CVE-2025-54353

JSON object : View

Products Affected

fortinet

fortisandbox

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-54353", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54353", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T20:19:54.050211Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSandbox", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.2"}, {"status": "affected", "version": "4.4.0", "versionType": "semver", "lessThanOrEqual": "4.4.7"}, {"status": "affected", "version": "4.2.1", "versionType": "semver", "lessThanOrEqual": "4.2.8"}, {"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "4.0.6"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-09T18:15:53.973", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-477", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests."}, {"lang": "es", "value": "Una vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') [CWE-79] vulnerabilidad en Fortinet FortiSandbox 5.0.0 hasta 5.0.2, FortiSandbox 4.4.0 hasta 4.4.7, FortiSandbox 4.2 todas las versiones, FortiSandbox 4.0 todas las versiones puede permitir a un atacante realizar un ataque XSS mediante solicitudes HTTP manipuladas."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AD9ECD5-FE5A-4772-A53A-04769828A110", "versionEndIncluding": "4.0.6", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "814D77BE-F536-42DE-B068-F92B95D68248", "versionEndIncluding": "4.2.8", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08D2984D-3F90-42A6-9DC9-5E853E7B3188", "versionEndIncluding": "4.4.7", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5335FAF-6569-44CE-8634-0991C738CCF9", "versionEndIncluding": "5.0.2", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}