This vulnerability involves improper neutralization of input during web page generation in Fortinet FortiSandbox PaaS versions 5.0.0 to 5.0.4, enabling cross-site scripting (CWE-79). An attacker can exploit this by crafting HTTP requests that inject malicious scripts, potentially leading to unauthorized code execution or command execution within the affected system. The CVSS 3.1 base score is 4.9, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vendor has released an official fix to remediate this vulnerability.

Successful exploitation of this XSS vulnerability could allow an attacker to execute unauthorized code or commands in the context of the affected FortiSandbox PaaS application. This may lead to limited confidentiality and integrity impacts but does not affect availability. There are no reports of active exploitation in the wild.

An official fix is available from Fortinet to remediate this vulnerability. Users should apply the vendor-provided patch to affected versions 5.0.0 through 5.0.4 of FortiSandbox and FortiSandbox PaaS. Since this is not a cloud service, remediation requires updating the affected software installations. No additional mitigation steps are indicated by the vendor advisory.