Cross-site scripting forgery (CSRF) in HTTPd CLI console Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-038 Final 1 1 2023-12-12T00:00:00 Current version 2023-12-12T00:00:00 2023-12-11T00:00:00 A cross-site scripting forgery vulnerability [CWE-352] in FortiMail, FortiNDR, FortiRecorder, FortiSwitch & FortiVoiceEnterprise may allow a remote and unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests. None Execute unauthorized code or commands Internally discovered and reported by Théo Leleu of Fortinet Product Security team. FortiMail 7.0.3 FortiMail 7.0.2 FortiMail 7.0.1 FortiMail 7.0.0 FortiMail 6.4.6 FortiMail 6.4.5 FortiMail 6.4.4 FortiMail 6.4.3 FortiMail 6.4.2 FortiMail 6.4.1 FortiMail 6.4.0 FortiMail 6.2.9 FortiMail 6.2.8 FortiMail 6.2.7 FortiMail 6.2.6 FortiMail 6.2.5 FortiMail 6.2.4 FortiMail 6.2.3 FortiMail 6.2.2 FortiMail 6.2.1 FortiMail 6.2.0 FortiMail 6.0.12 FortiMail 6.0.11 FortiMail 6.0.10 FortiMail 6.0.9 FortiMail 6.0.8 FortiMail 6.0.7 FortiMail 6.0.6 FortiMail 6.0.5 FortiMail 6.0.4 FortiMail 6.0.3 FortiMail 6.0.2 FortiMail 6.0.1 FortiMail 6.0.0 FortiNDR 7.1.0 FortiNDR 7.0.4 FortiNDR 7.0.3 FortiNDR 7.0.2 FortiNDR 7.0.1 FortiNDR 7.0.0 FortiNDR 1.5.3 FortiNDR 1.5.2 FortiNDR 1.5.1 FortiNDR 1.5.0 FortiNDR 1.4.0 FortiNDR 1.3.1 FortiNDR 1.3.0 FortiNDR 1.2.0 FortiNDR 1.1.0 FortiRecorder 6.4.2 FortiRecorder 6.4.1 FortiRecorder 6.4.0 FortiRecorder 6.0.11 FortiRecorder 6.0.10 FortiRecorder 6.0.9 FortiRecorder 6.0.8 FortiRecorder 6.0.7 FortiRecorder 6.0.6 FortiRecorder 6.0.5 FortiRecorder 6.0.4 FortiRecorder 6.0.3 FortiRecorder 6.0.2 FortiRecorder 6.0.1 FortiRecorder 6.0.0 FortiRecorder 2.7.7 FortiRecorder 2.7.6 FortiRecorder 2.7.5 FortiRecorder 2.7.4 FortiRecorder 2.7.3 FortiRecorder 2.7.2 FortiRecorder 2.7.1 FortiRecorder 2.7.0 FortiRecorder 2.6.3 FortiRecorder 2.6.2 FortiRecorder 2.6.1 FortiRecorder 2.6.0 FortiSwitch 7.0.4 FortiSwitch 7.0.3 FortiSwitch 7.0.2 FortiSwitch 7.0.1 FortiSwitch 7.0.0 FortiSwitch 6.4.10 FortiSwitch 6.4.9 FortiSwitch 6.4.8 FortiSwitch 6.4.7 FortiSwitch 6.4.6 FortiSwitch 6.4.5 FortiSwitch 6.4.4 FortiSwitch 6.4.3 FortiSwitch 6.4.2 FortiSwitch 6.4.1 FortiSwitch 6.4.0 FortiSwitch 6.2.8 FortiSwitch 6.2.7 FortiSwitch 6.2.6 FortiSwitch 6.2.5 FortiSwitch 6.2.4 FortiSwitch 6.2.3 FortiSwitch 6.2.2 FortiSwitch 6.2.1 FortiSwitch 6.2.0 FortiSwitch 6.0.7 FortiSwitch 6.0.6 FortiSwitch 6.0.5 FortiSwitch 6.0.4 FortiSwitch 6.0.3 FortiSwitch 6.0.2 FortiSwitch 6.0.1 FortiSwitch 6.0.0 FortiVoice 6.4.7 FortiVoice 6.4.6 FortiVoice 6.4.5 FortiVoice 6.4.4 FortiVoice 6.4.3 FortiVoice 6.4.2 FortiVoice 6.4.1 FortiVoice 6.4.0 FortiVoice 6.0.11 FortiVoice 6.0.10 FortiVoice 6.0.9 FortiVoice 6.0.8 FortiVoice 6.0.7 FortiVoice 6.0.6 FortiVoice 6.0.5 FortiVoice 6.0.4 FortiVoice 6.0.3 FortiVoice 6.0.2 FortiVoice 6.0.1 FortiVoice 6.0.0 CVE-2022-27488 FortiMail-7.0.3 FortiMail-7.0.2 FortiMail-7.0.1 FortiMail-7.0.0 FortiMail-6.4.6 FortiMail-6.4.5 FortiMail-6.4.4 FortiMail-6.4.3 FortiMail-6.4.2 FortiMail-6.4.1 FortiMail-6.4.0 FortiMail-6.2.9 FortiMail-6.2.8 FortiMail-6.2.7 FortiMail-6.2.6 FortiMail-6.2.5 FortiMail-6.2.4 FortiMail-6.2.3 FortiMail-6.2.2 FortiMail-6.2.1 FortiMail-6.2.0 FortiMail-6.0.12 FortiMail-6.0.11 FortiMail-6.0.10 FortiMail-6.0.9 FortiMail-6.0.8 FortiMail-6.0.7 FortiMail-6.0.6 FortiMail-6.0.5 FortiMail-6.0.4 FortiMail-6.0.3 FortiMail-6.0.2 FortiMail-6.0.1 FortiMail-6.0.0 FortiNDR-7.1.0 FortiNDR-7.0.4 FortiNDR-7.0.3 FortiNDR-7.0.2 FortiNDR-7.0.1 FortiNDR-7.0.0 FortiNDR-1.5.3 FortiNDR-1.5.2 FortiNDR-1.5.1 FortiNDR-1.5.0 FortiNDR-1.4.0 FortiNDR-1.3.1 FortiNDR-1.3.0 FortiNDR-1.2.0 FortiNDR-1.1.0 FortiRecorder-6.4.2 FortiRecorder-6.4.1 FortiRecorder-6.4.0 FortiRecorder-6.0.11 FortiRecorder-6.0.10 FortiRecorder-6.0.9 FortiRecorder-6.0.8 FortiRecorder-6.0.7 FortiRecorder-6.0.6 FortiRecorder-6.0.5 FortiRecorder-6.0.4 FortiRecorder-6.0.3 FortiRecorder-6.0.2 FortiRecorder-6.0.1 FortiRecorder-6.0.0 FortiRecorder-2.7.7 FortiRecorder-2.7.6 FortiRecorder-2.7.5 FortiRecorder-2.7.4 FortiRecorder-2.7.3 FortiRecorder-2.7.2 FortiRecorder-2.7.1 FortiRecorder-2.7.0 FortiRecorder-2.6.3 FortiRecorder-2.6.2 FortiRecorder-2.6.1 FortiRecorder-2.6.0 FortiSwitch-7.0.4 FortiSwitch-7.0.3 FortiSwitch-7.0.2 FortiSwitch-7.0.1 FortiSwitch-7.0.0 FortiSwitch-6.4.10 FortiSwitch-6.4.9 FortiSwitch-6.4.8 FortiSwitch-6.4.7 FortiSwitch-6.4.6 FortiSwitch-6.4.5 FortiSwitch-6.4.4 FortiSwitch-6.4.3 FortiSwitch-6.4.2 FortiSwitch-6.4.1 FortiSwitch-6.4.0 FortiSwitch-6.2.8 FortiSwitch-6.2.7 FortiSwitch-6.2.6 FortiSwitch-6.2.5 FortiSwitch-6.2.4 FortiSwitch-6.2.3 FortiSwitch-6.2.2 FortiSwitch-6.2.1 FortiSwitch-6.2.0 FortiSwitch-6.0.7 FortiSwitch-6.0.6 FortiSwitch-6.0.5 FortiSwitch-6.0.4 FortiSwitch-6.0.3 FortiSwitch-6.0.2 FortiSwitch-6.0.1 FortiSwitch-6.0.0 FortiVoice-6.4.7 FortiVoice-6.4.6 FortiVoice-6.4.5 FortiVoice-6.4.4 FortiVoice-6.4.3 FortiVoice-6.4.2 FortiVoice-6.4.1 FortiVoice-6.4.0 FortiVoice-6.0.11 FortiVoice-6.0.10 FortiVoice-6.0.9 FortiVoice-6.0.8 FortiVoice-6.0.7 FortiVoice-6.0.6 FortiVoice-6.0.5 FortiVoice-6.0.4 FortiVoice-6.0.3 FortiVoice-6.0.2 FortiVoice-6.0.1 FortiVoice-6.0.0 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-22-038 Cross-site scripting forgery (CSRF) in HTTPd CLI console Reference>