PT-2024-1744 · Fortinet · Fortinac

Published 2024-02-13 · Updated 2024-03-01 · CVE-2023-26206

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiNAC versions 7.2.0 Fortinet FortiNAC versions 9.1.0 through 9.1.10 Fortinet FortiNAC versions 9.2.0 through 9.2.8 Fortinet FortiNAC versions 9.4.0 through 9.4.2

Description The issue is related to an improper neutralization of input during web page generation, also known as cross-site scripting (XSS), which allows an attacker to execute unauthorized code or commands. This can be achieved via the name fields observed in the policy audit logs.

Recommendations For Fortinet FortiNAC version 7.2.0, update to a version that includes the fix for this issue. For Fortinet FortiNAC versions 9.1.0 through 9.1.10, update to a version that includes the fix for this issue. For Fortinet FortiNAC versions 9.2.0 through 9.2.8, update to a version that includes the fix for this issue. For Fortinet FortiNAC versions 9.4.0 through 9.4.2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the policy audit logs to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-01455

CVE-2023-26206

Affected Products

Fortinac

References · 7

• https://osv.dev/vulnerability/CVE-2023-26206 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26206 · Security Note
• https://bdu.fstec.ru/vul/2024-01455 · Security Note
• https://twitter.com/CVEnew/status/1758136193630564710 · Twitter Post
• https://t.me/cvenotify/72850 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1758155139569823879 · Twitter Post