CVE-2021-43081

published 2022-05-11

CVE-2021-43081: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below…

medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet_fortiproxy	—	—
fortinet	fortios	—	—
fortinet	fortios	6.0.0 – 6.0.14	—
fortinet	fortios	6.2.0 – 6.2.10	—
fortinet	fortios	>= 6.4.0 < 6.4.9	6.4.9
fortinet	fortios	>= 7.0.0 < 7.0.4	7.0.4
fortinet	fortiproxy	—	—
fortinet	fortiproxy	>= 2.0.0 < 2.0.8	2.0.8
fortinet	fortiproxy	>= 7.0.0 < 7.0.2	7.0.2

CWE-79