Cross-Site Scripting Vulnerability in Fortinet FortiDeceptor
CVE-2024-35280

5.1MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortideceptor
Vendor
CVE Published:
15 January 2025

Summary

An improper neutralization of input during web page generation in Fortinet's FortiDeceptor can lead to a reflected cross-site scripting attack. This vulnerability allows an attacker to manipulate recovery endpoints, potentially executing malicious scripts in the context of the victim's browser, thereby compromising user data and system integrity. The affected versions of FortiDeceptor include all versions of 3.x, 4.x, 5.0, 5.1 and specific versions 5.2.0 and 5.3.0. To mitigate the risks, users are advised to apply the recommended patches and implement necessary security measures.

Affected Version(s)

FortiDeceptor 5.3.0

FortiDeceptor 5.2.0

FortiDeceptor 5.1.0

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-010

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.