Cross-Site Scripting Vulnerability in Fortinet FortiDeceptor

CVE-2024-35280

What is CVE-2024-35280?

An improper neutralization of input during web page generation in Fortinet's FortiDeceptor can lead to a reflected cross-site scripting attack. This vulnerability allows an attacker to manipulate recovery endpoints, potentially executing malicious scripts in the context of the victim's browser, thereby compromising user data and system integrity. The affected versions of FortiDeceptor include all versions of 3.x, 4.x, 5.0, 5.1 and specific versions 5.2.0 and 5.3.0. To mitigate the risks, users are advised to apply the recommended patches and implement necessary security measures.

References