CVE-2021-26092: Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0…

PriorityP427medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

1.06%

60.6th percentile

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortios	—	—
fortinet	fortios	5.2.10 – 5.2.15	—
fortinet	fortios	5.4.0 – 5.4.13	—
fortinet	fortios	5.6.0 – 5.6.14	—
fortinet	fortios	6.0.0 – 6.0.12	—
fortinet	fortios	6.2.0 – 6.2.7	—
fortinet	fortios	6.4.0 – 6.4.4	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	—	—
fortinet	fortiproxy	1.2.0 – 1.2.9	—

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.