[SSL VPN Portal] Reflected XSS via the error request Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-20-199 Final 1 1 2021-06-01T00:00:00 Current version 2021-06-01T00:00:00 2021-06-01T00:00:00 Failure to sanitize input in the SSL VPN web portal may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters. Execute unauthorized code or commands FortiGate versions 5.6.13 and below.FortiGate versions 6.0.12 and below.FortiGate versions 6.2.7 and below.FortiGate versions 6.4.5 and below.FortiProxy version 2.0.0 through 2.0.1FortiProxy version 1.2.0 through 1.2.9 Please upgrade to FortiGate version 6.0.13 or above.Please upgrade to FortiGate version 6.2.8 or above.Please upgrade to FortiGate version 6.4.6 or above.Please upgrade to FortiGate version 7.0.0 or above.For new high-end F-Series Models (FG-1800F, FG-3800F, FG-4200F, FG-4400F) please upgrade to 6.2.9Please upgrade to FortiProxy version 2.0.2 or above.Please upgrade to FortiProxy version 1.2.10 or above. Fortinet is pleased to thank Damian Rusinek for reporting this issue under responsible disclosure. CVE-2021-26092 4.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-20-199 [SSL VPN Portal] Reflected XSS via the error request Reference>