| IR Number | FG-IR-20-068 |
| Date | Dec 1, 2020 |
| Component | GUI |
| Severity |
Medium |
| CVSSv3 Score | 4.6 |
| Impact | Unauthorized code execution |
| CVE ID | CVE-2020-15937 |
| Affected Products |
FortiOS
:
6.4.1, 6.4.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
|
| CVRF | Download |
Refine Search
PSIRT Advisories
XSS vulnerability observed in Log and Report section of FortiGate
Summary
An improper neutralization of input vulnerability in the FortiGate may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.
Affected Products
FortiGate version 6.2.2 to 6.2.5.FortiGate version 6.4.1 and below.
Please note that FortiGate version 5.6.x, 6.0.x, 6.2.0, 6.2.1 are NOT impacted by this issue.
Solutions
Please upgrade to FortiGate version 6.4.2 or above. Please upgrade to FortiGate version 6.2.6 or above.Acknowledgement
Fortinet is pleased to thank Forster Chiu from CYBERGROOT LTD; Mark Chapman of Chapman Technology Group, Inc; Wenceslas Lejeune and the SOC team from Cheops Technology and OÄŸuz DOKUMACI for reporting this vulnerability under responsible disclosure.