CVE-2023-29183: Stored XSS in guest management page

Q: What is the vulnerability ID of this security issue?

The vulnerability ID of this security issue is CVE-2023-29183.

Q: What is the severity of CVE-2023-29183?

The severity of CVE-2023-29183 is high.

Q: Which software versions are affected by CVE-2023-29183?

FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, and FortiOS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.13, and 6.2.0 through 6.2.15 are affected by CVE-2023-29183.

Q: What is the CWE-ID associated with CVE-2023-29183?

The CWE-ID associated with CVE-2023-29183 is CWE-79.

Q: How can I fix the CVE-2023-29183 vulnerability?

To fix the CVE-2023-29183 vulnerability, it is recommended to update FortiProxy and FortiOS to the latest versions available, as the issue has been patched in later releases.

Published Sep 13, 2023

Updated

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS and FortiProxy GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.

Other sources

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.

Affected Software

12 affected componentsFixes available

Fortinet FortiOS>=7.2.0<=7.2.4

Fortinet FortiOS>=7.0.0<=7.0.11

Fortinet FortiOS>=6.4.0<=6.4.12

Fortinet FortiOS>=6.2.0<=6.2.14

Fortinet FortiProxy>=7.2.0<=7.2.4

Fortinet FortiProxy>=7.0.0<=7.0.10

Fortinet FortiProxy>=7.0.0<7.0.11

Fortinet FortiProxy>=7.2.0<7.2.5

Fortinet FortiOS>=6.2.0<6.2.15

Fortinet FortiOS>=6.4.0<6.4.13

Fortinet FortiOS>=7.0.0<7.0.12

Fortinet FortiOS>=7.2.0<7.2.5

Remediation

Information

Please upgrade to FortiProxy version 7.2.5 or above Please upgrade to FortiProxy version 7.0.11 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.15 or above

Event History

Sep 13, 2023

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·12:29 PM

Data Sourced

via MITRE·12:29 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this security issue?