PT-2021-9845 · Fortinet · Forticlientems

Published 2021-11-02 · Updated 2021-11-04 · CVE-2020-15940

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiClientEMS versions 6.4.1 and below FortiClientEMS versions 6.2.9 and below

Description An improper neutralization of input issue may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server.

Recommendations For FortiClientEMS versions 6.4.1 and below, consider restricting access to the name parameter in the affected sections of the server until a patch is available. For FortiClientEMS versions 6.2.9 and below, consider restricting access to the name parameter in the affected sections of the server until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15940

Affected Products

Forticlientems

References · 4

• https://fortiguard.com/advisory/FG-IR-20-067 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15940 · Security Note
• https://t.me/cibsecurity/31633 · Telegram Post