PT-2025-10765 · Fortinet · Fortiadc Gui

Published 2025-03-11 · Updated 2025-03-13 · CVE-2023-37933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FortiADC versions 7.2.0 through 7.2.1 FortiADC version 7.4.0 FortiADC versions prior to 7.1.3

Description: The issue is related to an improper neutralization of input during web page generation, also known as 'Cross-site Scripting' [CWE-79]. This allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPS requests.

Recommendations: For FortiADC versions 7.2.0 through 7.2.1, consider disabling access to the GUI until a patch is available. For FortiADC version 7.4.0, restrict access to the vulnerable GUI components to minimize the risk of exploitation. For FortiADC versions prior to 7.1.3, avoid using the vulnerable GUI functionality until the issue is resolved. As a temporary workaround, consider disabling the vulnerable web page generation functionality until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37933

Affected Products

Fortiadc Gui

References · 7

• https://fortiguard.com/psirt/FG-IR-23-216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37933 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37933 · Vendor Advisory
• https://reddit.com/r/k12cybersecurity/comments/1j9jupx/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/true_secator/6837 · Telegram Post
• https://twitter.com/cybercronai/status/1899868765438759183 · Twitter Post
• https://twitter.com/CVEnew/status/1899479453161463842 · Twitter Post