Sandstorm

First CVE: Feb 6, 2018Active for: 8 yearsTotal CVEs: 4

Sandstorm is a self-hosted, open-source platform for collaboration and application hosting that allows users to run third-party applications in isolated containers. Its observed vulnerability pattern centers on information disclosure, authentication weaknesses, server-side request forgery, and resource-consumption flaws, reflecting the complexity inherent in sandboxing untrusted application code and managing cross-application isolation boundaries. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.

FAUCET AI Generated
4
Total CVEs
More Total CVEs than 79% of tracked vendors
4.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 95% of tracked vendors
7.7
Avg CVSS Score
Higher Avg CVSS Score than 73% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Sandstorm over time

Volume of CVEsAvg CVSS Base Score
First CVE
Feb 6, 2018
8 years ago
Most Recent CVE
Feb 6, 2018
3,090 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (4 CVEs).

4 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2017-6199CRITICAL
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.
Feb 6, 20189.829NONO
CVE-2017-6201HIGH
A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could
Feb 6, 20188.124NONO
CVE-2017-6200MEDIUM
Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip functi
Feb 6, 20186.522NONO
CVE-2017-6198MEDIUM
The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sand
Feb 6, 20186.520NONO
View all 4 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products4 CVEs
Severity distribution among all CVEs352,231 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network4 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None4 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low3 (75.0%)
High0 (0.0%)
None1 (25.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (4 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Sandstorm.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Sandstorm — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Sandstorm's Products

View all 1 CNAs →

Top CWEs