XSS vulnerability in OWA login page

Summary

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

Affected Products

FortiAuthenticator OutlookAgent version 2.1 through 2.2

Solutions

Please upgrade to FortiAuthenticator Agent for Microsoft OWA version 2.3 or above.

Acknowledgement

Fortinet is pleased to thank Mohamad Hammad for bringing this issue to our attention under responsible disclosure.

Timeline

2022-06-07: Initial publication