CVE-2023-36637: XSS
Published Oct 10, 2023
·Updated
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields.
Affected Software
4 affected components
Fortinet FortiMail>=7.0.1<=7.0.5
Fortinet FortiMail=7.2.0
Fortinet FortiMail=7.2.1
Fortinet FortiMail=7.2.2
Remediation
Information
Please upgrade to FortiMail version 7.4.0 or above Please upgrade to FortiMail version 7.2.3 or above Please upgrade to FortiMail version 7.0.6 or above
Event History
Oct 10, 2023
CVE Published
via MITRE·04:50 PM
Data Sourced
via MITRE·04:50 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-36637?
The severity of CVE-2023-36637 is medium with a CVSS score of 5.4.
2
How does CVE-2023-36637 affect FortiMail?
CVE-2023-36637 affects FortiMail versions 7.2.0 through 7.2.2 and before 7.0.5.
3
What is the CWE category for CVE-2023-36637?
CVE-2023-36637 belongs to the CWE-79 category.
4
How can an attacker exploit CVE-2023-36637?
An authenticated attacker can exploit CVE-2023-36637 by injecting HTML tags in FortiMail's calendar via input fields.
5
Is there a patch or fix available for CVE-2023-36637?
A fix for CVE-2023-36637 is available in FortiMail version 7.0.5 and later.