PT-2020-6795 · Fortinet · Fortiwlc

Published 2020-06-21 · Updated 2020-06-26 · CVE-2020-9288

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiWLC version 8.5.1

Description The issue is related to the lack of protection of the web page structure in the ESS profile and Radius microprogram software of FortiWLC wireless access controllers. This can be exploited by a remote attacker to perform cross-site scripting attacks. Specifically, an improper neutralization of input allows a remote authenticated attacker to perform a stored cross-site scripting attack via the ESS profile or the Radius Profile.

Recommendations For FortiWLC version 8.5.1, consider restricting access to the ESS profile and Radius Profile until a patch is available. As a temporary workaround, avoid using the vulnerable profiles to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06589

CVE-2020-9288

Affected Products

Fortiwlc

References · 4

• https://bdu.fstec.ru/vul/2022-06589 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9288 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9288 · Vendor Advisory