description: An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.
problem types: Execute unauthorized code or commands
affected:
{
vendor: Fortinet
product: FortiAuthenticator
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.4, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.3, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.2, status: affected
versionType: semver, version: 6.1.0, lessThanOrEqual: 6.1.3, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C
]
solutions: Please upgrade to FortiAuthenticator version 6.5.0 or above Please upgrade to FortiAuthenticator version 6.4.7 or above Please upgrade to FortiAuthenticator version 6.4.5 or above Please upgrade to FortiAuthenticator version 6.3.4 or above