EMS can send javascript code to client through messages

Summary

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiClient may allow the EMS administrator to send messages containing javascript code.

Acknowledgement

Internally discovered and reported by Théo Leleu of Fortinet Product Security team. Fortinet is also pleased to thank Anders Sjögren from Root Cause Security and Yaniv Nizry from Sonar for reporting this vulnerability under responsible disclosure.

Timeline

2025-04-08: Initial publication