Vulnerability CVE-2021-43062

Vulnerability CVE-2021-43062

Published: 2022-02-02

Description:

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Fortinet Fortimail 7.0.1 Cross Site Scripting	Braiant Giraldo ...	20.02.2022

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Fortinet -> Fortimail

References:

https://fortiguard.com/advisory/FG-IR-21-185

Copyright 2024, cxsecurity.com