4.7
Medium
CVE-2021-26092 Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0…
Description
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS, FortiProxy | Versions not published |
References
- fortiguard.com fortiguard.com
Timeline
- Published
- Last modified
Other CVEs of Fortinet FortiOS, FortiProxy
The 6 CVEs of Fortinet FortiOS, FortiProxy →
CVE-2022-29055
A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0…
7.5
High
CVE-2021-43206
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through…
4.3
Medium
CVE-2021-26110
An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below,…
7.8
High
CVE-2018-13382
Fortinet FortiOS and FortiProxy Improper Authorization
9.1
Critical