CVE-2020-12816: XSS vulnerability in the UserID of Admin Users in FortiNAC

Q: What is CVE-2020-12816?

CVE-2020-12816 is an improper neutralization of input vulnerability in FortiNAC before 8.7.2 that may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.

Q: How does CVE-2020-12816 affect FortiNAC?

CVE-2020-12816 affects FortiNAC versions before 8.7.2.

Q: What is the severity of CVE-2020-12816?

The severity of CVE-2020-12816 is medium with a CVSS score of 6.1.

Q: How can an attacker exploit CVE-2020-12816?

An attacker with remote authentication can exploit CVE-2020-12816 by performing a stored cross site scripting (XSS) attack using the UserID of Admin Users.

Q: Is there a fix for CVE-2020-12816?

Yes, updating FortiNAC to version 8.7.2 or above will fix CVE-2020-12816.

Published Sep 23, 2020

Updated

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.

Affected Software

1 affected component

Fortinet FortiNAC<8.7.3

Event History

Sep 23, 2020

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Sep 24, 2020

CVE Published

via MITRE·01:29 PM

Data Sourced

via MITRE·01:29 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-12816?

CVE-2020-12816 is an improper neutralization of input vulnerability in FortiNAC before 8.7.2 that may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.

How does CVE-2020-12816 affect FortiNAC?

CVE-2020-12816 affects FortiNAC versions before 8.7.2.

What is the severity of CVE-2020-12816?