FG-IR-24-033: SSLVPN WEB UI Text injection
An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS and FortiProxy SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-033?
The severity of FG-IR-24-033 is high due to its potential for remote unauthenticated access leading to phishing attacks.
How do I fix FG-IR-24-033?
To fix FG-IR-24-033, upgrade to FortiOS version 7.4.4 or 7.2.9 and to FortiProxy version 7.4.4 or 7.2.10.
What software is affected by FG-IR-24-033?
FG-IR-24-033 affects Fortinet FortiOS versions 7.4.0 to 7.4.3, 7.2.0 to 7.2.8, and FortiProxy versions 7.4.0 to 7.4.3, 7.2.0 to 7.2.9.
Can FG-IR-24-033 be exploited without authentication?
Yes, FG-IR-24-033 allows remote unauthenticated attackers to exploit the vulnerability through crafted requests.
What does FG-IR-24-033 specifically target?
FG-IR-24-033 targets an improper neutralization of special elements in output, enabling injection attacks in SSL-VPN web user interfaces.