FG-IR-23-471: FortiOS/FortiProxy - XSS in reboot page
An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS and FortiProxy reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-471?
The FG-IR-23-471 vulnerability is classified as a high severity security risk due to the potential for remote code execution.
How do I fix FG-IR-23-471?
To remediate FG-IR-23-471, upgrade FortiOS to version 7.4.4 or higher, FortiOS 7.2.8 or higher, or FortiOS 7.0.14 or higher, as applicable.
Who is affected by FG-IR-23-471?
FG-IR-23-471 affects FortiOS and FortiProxy versions 7.4.0 to 7.4.3, 7.2.0 to 7.2.7, and 7.0.0 to 7.0.13.
What types of attacks can FG-IR-23-471 enable?
FG-IR-23-471 can enable an attacker with super-admin access to execute arbitrary JavaScript code on the targeted web page.
What is the nature of FG-IR-23-471 vulnerability?
The FG-IR-23-471 vulnerability is a Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation.