Cyber Resilience

CVE-2024-27781

High

Published: 11 February 2025

Published
11 February 2025
Modified
14 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0751 92.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-27781 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Fortinet Fortisandbox. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2024-27781 is a cross-site scripting vulnerability caused by improper neutralization of input during web page generation in Fortinet FortiSandbox. The flaw affects versions 4.4.0 through 4.4.4, 4.2.1 through 4.2.6, 4.0.0 through 4.0.4, and all versions of 3.2, 3.1, and 3.0, and is tracked under CWE-79.

An authenticated attacker can exploit the issue over the network by submitting crafted HTTP requests, resulting in execution of unauthorized code or commands. The vulnerability carries a CVSS 3.1 score of 7.1 with the vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.

Fortinet has published advisory FG-IR-24-063 addressing the issue. The associated EPSS score has remained flat at 0.0751 with no material increase observed.

EU & UK References

Vulnerability details

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an…

more

authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

XSS (CWE-79) in network-accessible web management interface directly enables exploitation of public-facing application (T1190) and injection/execution of arbitrary JavaScript (T1059.007) via crafted requests.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-52436Same product: Fortinet Fortisandbox
CVE-2026-39808Same product: Fortinet Fortisandbox
CVE-2024-27778Same product: Fortinet Fortisandbox
CVE-2024-52961Same product: Fortinet Fortisandbox
CVE-2026-39813Same product: Fortinet Fortisandbox
CVE-2024-52960Same product: Fortinet Fortisandbox
CVE-2024-26006Same vendor: Fortinet
CVE-2024-54027Same product: Fortinet Fortisandbox
CVE-2024-54018Same product: Fortinet Fortisandbox
CVE-2025-53949Same product: Fortinet Fortisandbox

Affected Assets

fortinet
fortisandbox
3.0.0 — 4.0.5 · 4.2.0 — 4.2.7 · 4.4.0 — 4.4.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 mandates information input validation, directly addressing the improper neutralization of input during web page generation that enables this XSS vulnerability in FortiSandbox.

SI-15 Information Output Filtering good match
prevent

SI-15 requires information output filtering, preventing the injection of malicious scripts into generated web pages viewed by authenticated users exploiting this CVE.

SI-2 Flaw Remediation good match
prevent

SI-2 ensures timely flaw remediation through patching, directly mitigating this specific XSS vulnerability as recommended in the Fortinet advisory.

References