PSIRT Advisory
FortiSIEM - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious JavaScript code into the description field of a Device Maintenance schedule.
Impact
Unauthorized code execution
Affected Products
FortiSIEM version 5.2.5 and below.
Solutions
Please upgrade to FortiSIEM version 5.2.6 and above.
Acknowledgement
Fortinet is very pleased to thank Luca Sangalli (luca91.sanga@gmail.com ; https://it.linkedin.com/in/luca-sangalli-0a6462105 ) for bringing this issue to our attention under responsible disclosure and for helping us make our products more secure.