Improper Input Neutralization in FortiWebManager by Fortinet
CVE-2021-36175

4.1MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortinet Fortiwebmanager
Vendor
CVE Published:
6 October 2021

What is CVE-2021-36175?

An improper input neutralization vulnerability has been identified in FortiWebManager versions 6.2.3 and prior. This issue can be exploited by a remote authenticated attacker to inject arbitrary scripts or tags through the name, description, and comment fields across various sections of the device. Such attacks can lead to serious security implications, including the execution of unauthorized actions within the system.

Affected Version(s)

Fortinet FortiWebManager FortiWebManager 6.0.2 6.2.3

References

https://fortiguard.com/advisory/FG-IR-20-027
x_refsource_CONFIRM

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.