CVE-2021-24021: XSS vulnerability observed in the Column settings of LogView
An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks.
Other sources
An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-24021.
What is the severity of CVE-2021-24021?
The severity of CVE-2021-24021 is medium with a CVSS score of 5.4.
Which versions of FortiAnalyzer are affected by CVE-2021-24021?
FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below, and 6.0.10 and below are affected by CVE-2021-24021.
What is the CWE (Common Weakness Enumeration) ID of CVE-2021-24021?
The CWE ID of CVE-2021-24021 is CWE-79.
How can a remote attacker exploit CVE-2021-24021?
A remote authenticated attacker can exploit CVE-2021-24021 by performing a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer.