CVE-2021-43081

published 2022-05-11

CVE-2021-43081: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below…

Priority P4 26 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet_fortiproxy	—	—
fortinet	fortios	—	—
fortinet	fortios	6.0.0 – 6.0.14	—
fortinet	fortios	6.2.0 – 6.2.10	—
fortinet	fortios	>= 6.4.0 < 6.4.9	6.4.9
fortinet	fortios	>= 7.0.0 < 7.0.4	7.0.4
fortinet	fortiproxy	—	—
fortinet	fortiproxy	>= 2.0.0 < 2.0.8	2.0.8
fortinet	fortiproxy	>= 7.0.0 < 7.0.2	7.0.2

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79