CVE-2021-32597

CVE Database · CVE-2021-32597

CVE-2021-32597

· MEDIUMModified

CVSS v3.1

4.6

EPSS

0.60%

Published

Aug 6, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (6)

fortinet · fortianalyzer (up to 6.2.8)vulnerable

fortinet · fortianalyzer (up to 6.4.6)vulnerable

fortinet · fortianalyzer (up to 7.0.1)vulnerable

fortinet · fortimanager (up to 6.2.8)vulnerable

fortinet · fortimanager (up to 6.4.6)vulnerable

fortinet · fortimanager (up to 7.0.1)vulnerable

References (2)

https://fortiguard.com/advisory/FG-IR-21-054

Vendor Advisory

https://fortiguard.com/advisory/FG-IR-21-054

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs