Reflected Cross-site Scripting Vulnerability in FortiOS and FortiProxy
CVE-2021-26092

4.7MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet FortiOS, Fortiproxy
Vendor
CVE Published:
24 February 2022

Summary

A vulnerability exists in the SSL VPN web portal of FortiOS and FortiProxy due to insufficient input sanitization. Attackers can exploit this flaw by sending crafted requests with malicious GET parameters to the error page, enabling them to perform reflected Cross-site Scripting (XSS) attacks. This allows for unauthorized access and control over the web portal, potentially compromising sensitive information and functionalities.

Affected Version(s)

Fortinet FortiOS, FortiProxy FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1

References

https://fortiguard.com/psirt/FG-IR-20-199
x_refsource_CONFIRM

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.