PT-2021-19801 · Fortinet · Fortiportal Gui

Published 2021-08-18 · Updated 2021-08-25 · CVE-2021-32602

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiPortal GUI versions 6.0.4 and below FortiPortal GUI versions 5.3.6 and below FortiPortal GUI versions 5.2.6 and below FortiPortal GUI versions 5.1.2 and below FortiPortal GUI versions 5.0.3 and below FortiPortal GUI versions 4.2.2 and below FortiPortal GUI versions 4.1.2 and below FortiPortal GUI versions 4.0.4 and below

Description The issue is related to an improper neutralization of input during web page generation, which may allow a remote and unauthenticated attacker to perform an XSS attack. This can be achieved by sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value.

Recommendations For FortiPortal GUI versions 6.0.4 and below, update to a version above 6.0.4 to resolve the issue. For FortiPortal GUI versions 5.3.6 and below, update to a version above 5.3.6 to resolve the issue. For FortiPortal GUI versions 5.2.6 and below, update to a version above 5.2.6 to resolve the issue. For FortiPortal GUI versions 5.1.2 and below, update to a version above 5.1.2 to resolve the issue. For FortiPortal GUI versions 5.0.3 and below, update to a version above 5.0.3 to resolve the issue. For FortiPortal GUI versions 4.2.2 and below, update to a version above 4.2.2 to resolve the issue. For FortiPortal GUI versions 4.1.2 and below, update to a version above 4.1.2 to resolve the issue. For FortiPortal GUI versions 4.0.4 and below, update to a version above 4.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the lang parameter and the org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32602

Affected Products

Fortiportal Gui

References · 5

• https://fortiguard.com/advisory/FG-IR-20-066 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32602 · Security Note
• https://t.me/cvenotify/19695 · Telegram Post
• https://t.me/cvenotify/19717 · Telegram Post