Input Injection Vulnerability in FortiAnalyzer by Fortinet
CVE-2020-12817

8.8HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortianalyzer
Vendor
CVE Published:
24 September 2020

Summary

A vulnerability in FortiAnalyzer, present in versions prior to 6.4.1 and 6.2.5, allows remote authenticated attackers to exploit improper input neutralization. By injecting script-related HTML tags via the Name parameter of Storage Connectors, attackers can potentially execute arbitrary scripts within the web interface, leading to unauthorized access and manipulation of sensitive data.

Affected Version(s)

Fortinet FortiAnalyzer FortiAnalyzer before 6.4.1; before 6.2.5

References

https://fortiguard.com/advisory/FG-IR-20-054
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.