CVE-2023-29183 — Cross-site Scripting in Fortinet Fortios

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
CNA8.0
EPSS
0.6%
top 30.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiosFortinet Fortiproxy
Timeline
PublishedSep 13

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶NVDfortinet/fortios6.2.0 — 6.2.15+3
▶NVDfortinet/fortiproxy7.0.0 — 7.0.11+1
▶CVEListV5fortinet/fortios7.2.0 — 7.2.4+3
▶CVEListV5fortinet/fortiproxy7.2.0 — 7.2.4+1

🔴Vulnerability Details

2
CVEList
CVE-2023-29183: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7↗2023-09-13
▶
GHSA
GHSA-576v-9h7m-r2jq: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7↗2023-09-13
▶

📋Vendor Advisories

1
Fortinet
Stored XSS in guest management page↗2023-09-13
▶
CVE-2023-29183 — Cross-site Scripting in Fortinet | cvebase