CVE-2020-12811
published 2020-09-24CVE-2020-12811: A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.81%
56.6th percentile
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortianalyzer | — | — |
| fortinet | fortianalyzer | 6.2.0 – 6.2.6 | — |
| fortinet | fortianalyzer | 6.2.7 – 6.2.11 | — |
| fortinet | fortimanager | — | — |
| fortinet | fortimanager | — | — |
| fortinet | fortimanager | 6.2.0 – 6.2.6 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and F...
vendor_fortinet·2020-09-24·CVSS 6.1
CVE-2020-12811 [MEDIUM] CWE-79 An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and F...
FG-IR-20-005: An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and F...
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field.
CVEs: CVE-2020-12811
CWEs: CWE-79
CVSS: 6.1 (medium)
Affected products: FortiAnalyzer, FortiManager
VulDB
Fortinet FortiManager/FortiAnalyzer cross site scripting
vuldb·2026-10-13·CVSS 6.1
CVE-2020-12811 [MEDIUM] Fortinet FortiManager/FortiAnalyzer cross site scripting
A vulnerability labeled as problematic has been found in Fortinet FortiManager and FortiAnalyzer. This issue affects some unknown processing. Executing a manipulation can lead to cross site scripting.
This vulnerability is handled as CVE-2020-12811. The attack can be executed remotely. There is not any exploit available.
GHSA
GHSA-956m-435w-x6jc: An improper neutralization of script-related HTML tags in a web page in FortiManager 6
ghsa_unreviewed·2022-05-24
CVE-2020-12811 [MEDIUM] GHSA-956m-435w-x6jc: An improper neutralization of script-related HTML tags in a web page in FortiManager 6
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-24
Published