CVE-2020-6646: XSS
Published Mar 17, 2020
·Updated
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.
Affected Software
2 affected components
Fortinet FortiWeb<=6.2.2
Fortinet FortiWeb=6.3.0
Event History
Mar 17, 2020
CVE Published
via MITRE·12:49 PM
Data Sourced
via MITRE·12:49 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-6646?
CVE-2020-6646 has been rated with a severity of medium due to its ability to allow stored cross site scripting attacks.
2
How do I fix CVE-2020-6646?
To mitigate CVE-2020-6646, it is recommended to upgrade FortiWeb to version 6.3.1 or later.
3
Who is affected by CVE-2020-6646?
CVE-2020-6646 affects FortiWeb users running versions up to and including 6.2.2 and version 6.3.0.
4
What type of attack can be executed due to CVE-2020-6646?
CVE-2020-6646 allows a remote authenticated attacker to perform a stored cross site scripting (XSS) attack.
5
What input is improperly neutralized in CVE-2020-6646?
CVE-2020-6646 involves an improper neutralization of input in the Disclaimer Description of a Replacement Message.