CVE-2023-22637

5.9MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinac
Vendor
CVE Published:
3 May 2023

Summary

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

Affected Version(s)

FortiNAC 9.4.0 <= 9.4.2

FortiNAC 9.2.0 <= 9.2.7

FortiNAC 9.1.0 <= 9.1.9

References

https://fortiguard.com/psirt/FG-IR-23-013

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.