CVE-2024-48893 — Cross-site Scripting in Fortinet Fortisoar

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
CNA6.8
EPSS
0.5%
top 35.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortisoar
Timeline
PublishedJan 14

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via the creation of malicious playbook.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5fortinet/fortisoar7.3.0 — 7.3.3+1
▶NVDfortinet/fortisoar7.2.1 — 7.3.3

🔴Vulnerability Details

2
CVEList
CVE-2024-48893: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7↗2025-01-14
▶
GHSA
GHSA-4wxp-6xr4-5pvw: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7↗2025-01-14
▶

📋Vendor Advisories

1
Fortinet
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3,...↗2025-01-14
▶
CVE-2024-48893 — Cross-site Scripting in Fortinet | cvebase