FortiAuthenticator - Reflected XSS in the password reset page

Summary

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Affected Products

FortiAuthenticator version 6.4.0 through 6.4.6
FortiAuthenticator version 6.3.0 through 6.3.3
FortiAuthenticator 6.2 all versions
FortiAuthenticator 6.1 all versions

Solutions

Please upgrade to FortiAuthenticator version 6.5.0 or above
Please upgrade to FortiAuthenticator version 6.4.7 or above
Please upgrade to FortiAuthenticator version 6.3.4 or above

Acknowledgement

Fortinet is pleased to thank Leandro Barragan from SwordBytes for reporting this vulnerability under responsible disclosure.