PT-2024-5733 · Fortinet · Fortiproxy+1

Published 2024-07-09 · Updated 2025-03-19 · CVE-2024-26006

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to the fixed version FortiProxy versions prior to the fixed version

Description The issue exists due to improper neutralization of input during web page generation, allowing a remote attacker to perform Cross-Site Scripting attacks. This can be achieved through social engineering, where the targeted user is tricked into bookmarking a malicious Samba server and then opening the bookmark.

Recommendations For FortiOS versions prior to the fixed version, update to the latest version to resolve the issue. For FortiProxy versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the web SSL VPN UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-06446

CVE-2024-26006

Affected Products

Fortios

Fortiproxy

References · 13

• https://osv.dev/vulnerability/CVE-2024-26006 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26006 · Security Note
• https://bdu.fstec.ru/vul/2024-06446 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-26006 · Security Note
• https://twitter.com/cracbot/status/1902314191668789370 · Twitter Post
• https://fortiguard.fortinet.com/psirt/FG-IR-23-485 · Note
• https://twitter.com/BillyFung2010/status/1811398927486460264 · Twitter Post
• https://twitter.com/CVEnew/status/1900482693617668220 · Twitter Post
• https://t.me/cvetracker/19113 · Telegram Post
• https://t.me/cvedetector/20283 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-23-485 · Note
• https://twitter.com/autumn_good_35/status/1810991378228519137 · Twitter Post
• https://tenable.com/cve/CVE-2024-26006 · Note