PT-2023-6003 · Fortinet · Fortios

Published 2023-10-10 · Updated 2023-10-13 · CVE-2023-36555

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.2.0 through 7.2.4

Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can allow an attacker to execute unauthorized code or commands. This can be achieved via the SAML and Security Fabric components. A remote attacker may exploit this to inject script-related HTML tags.

Recommendations For Fortinet FortiOS versions 7.2.0 through 7.2.4, consider disabling the SAML and Security Fabric components until a patch is available to prevent exploitation. Restrict access to these components to minimize the risk of unauthorized code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2023-06704

CVE-2023-36555

Affected Products

Fortios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-36555 · Security Note
• https://bdu.fstec.ru/vul/2023-06704 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-104 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36555 · Vendor Advisory
• https://t.me/cibsecurity/71973 · Telegram Post