PT-2021-7469 · Fortinet · Fortiweb

Andrey Medov · Published 2021-02-03 · Updated 2021-02-10 · CVE-2021-22122

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.7 FortiWeb versions prior to 6.2.4

Description The issue is related to an improper neutralization of input during web page generation in the FortiWeb GUI interface. This may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.

Recommendations For FortiWeb versions 6.3.0 through 6.3.7, update to a version outside of this range to resolve the issue. For FortiWeb versions prior to 6.2.4, update to version 6.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API end-points until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06595

CVE-2021-22122

Affected Products

Fortiweb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-22122 · Security Note
• https://bdu.fstec.ru/vul/2022-06595 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22122 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-20-122 · Vendor Advisory
• https://t.me/cibsecurity/23212 · Telegram Post
• https://t.me/cybersecuritytechnologies/2661 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-20-122 · Note