PSIRTXSS in default error page
Summary
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiADC virtual server's default error page may allow an unauthenticated attacker to execute malicious code via crafted URL.
| Version | Affected | Solution |
|---|---|---|
| FortiADC 8.0 | 8.0.0 | Upgrade to 8.0.1 or above |
| FortiADC 7.6 | 7.6.0 through 7.6.3 | Upgrade to 7.6.4 or above |
| FortiADC 7.4 | 7.4 all versions | Migrate to a fixed release |
| FortiADC 7.2 | 7.2 all versions | Migrate to a fixed release |
| FortiADC 7.1 | Not affected | Not Applicable |
| FortiADC 7.0 | Not affected | Not Applicable |
| FortiADC 6.2 | Not affected | Not Applicable |
Workarounds:
Do not use "waf_deny.html" error page or customise it to either remove the"error-info" class or to change it into a standard hardcoded message.