VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Sep 6, 2021· Updated Jun 17, 2026

CVE-2020-15939

CVE-2020-15939

Description

An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.

Affected products

3
  • Fortinet/Fortisandbox3 versions
    cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*range: <3.1.5
    • (no CPE)range: <=3.2.1, <=3.1.4
    • (no CPE)range: FortiSandbox 3.2.1, 3.1.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.