Headline
CVE-2021-36188: Fortiguard
A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers
PSIRT Advisories
FortiWeb - Reflected cross-site scripting in error controllers
Summary
Multiple improper neutralization of input during web page generation (‘Cross-site Scripting’) [CWE-79] in FortiWeb may allow an unauthenticated user to inject malicious javascript code into the response webpage via crafted requests to device’s error handlers.
Affected Products
FortiWeb version 6.4.1 and below are impacted.
FortiWeb version 6.3.15 and below are impacted.
FortiWeb version 6.2.5 and below are impacted.
Solutions
Upgrade to the upcoming FortiWeb version 7.0.0 or above.
Upgrade to FortiWeb version 6.4.2 or above.
Upgrade to FortiWeb version 6.3.16 or above.
Acknowledgement
Internally discovered and reported by Mattia Fecit of Fortinet Product Security team.