description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.
problem types: Execute unauthorized code or commands
affected:
{
vendor: Fortinet
product: FortiProxy
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.1, status: affected
versionType: semver, version: 2.0.0, lessThanOrEqual: 2.0.11, status: affected
versionType: semver, version: 1.2.0, lessThanOrEqual: 1.2.13, status: affected
versionType: semver, version: 1.1.0, lessThanOrEqual: 1.1.6, status: affected
}
{
vendor: Fortinet
product: FortiOS
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.3, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.9, status: affected
versionType: semver, version: 6.2.2, lessThanOrEqual: 6.2.12, status: affected
versionType: semver, version: 6.0.7, lessThanOrEqual: 6.0.15, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C
]
solutions: Please upgrade to FortiOS version 7.2.2
Please upgrade to FortiOS version 7.0.7
Please upgrade to FortiOS version 6.4.10 or above