PT-2023-5112 · Fortinet · Fortiproxy+1

Published

2023-09-13

·

Updated

2023-09-26

·

CVE-2023-29183

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FortiProxy versions 7.2.0 through 7.2.4 FortiProxy versions 7.0.0 through 7.0.10 FortiOS versions 7.2.0 through 7.2.4 FortiOS versions 7.0.0 through 7.0.11 FortiOS versions 6.4.0 through 6.4.12 FortiOS versions 6.2.0 through 6.2.14
Description The issue is related to an improper neutralization of input during web page generation, also known as Cross-site Scripting. This may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management settings.
Recommendations For FortiProxy versions 7.2.0 through 7.2.4, update to a version that includes the fix for this issue. For FortiProxy versions 7.0.0 through 7.0.10, update to a version that includes the fix for this issue. For FortiOS versions 7.2.0 through 7.2.4, update to a version that includes the fix for this issue. For FortiOS versions 7.0.0 through 7.0.11, update to a version that includes the fix for this issue. For FortiOS versions 6.4.0 through 6.4.12, update to a version that includes the fix for this issue. For FortiOS versions 6.2.0 through 6.2.14, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the GUI or disabling the guest management settings until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05688
CVE-2023-29183

Affected Products

Fortios
Fortiproxy