[FortiOS] Injection attacks in the WAF and IPS logs Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-20-068 Final 1 1 2020-12-01T00:00:00 Current version 2020-12-01T00:00:00 2020-12-01T00:00:00 An improper neutralization of input vulnerability in the FortiGate may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard. Execute unauthorized code or commands FortiGate version 6.2.2 to 6.2.5.FortiGate version 6.4.1 and below.Please note that FortiGate version 5.6.x, 6.0.x, 6.2.0, 6.2.1 are NOT impacted by this issue. Please upgrade to FortiGate version 6.4.2 or above.Please upgrade to FortiGate version 6.2.6 or above. Fortinet is pleased to thank Forster Chiu from CYBERGROOT LTD; Mark Chapman of Chapman Technology Group, Inc; Wenceslas Lejeune and the SOC team from Cheops Technology and Oğuz DOKUMACI from Oyuncusundan.com for reporting this vulnerability under responsible disclosure. CVE-2020-15937 4.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-20-068 [FortiOS] Injection attacks in the WAF and IPS logs Reference>