Paper/Archive/CVE-2023-22637

CVE-2023-22637

Fortinet FortiNAC — An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.…

EPSS 0.6%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 49.2.492 × 209.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

Affected

ProductAffectedFixed inSource

FortiNAC9.4.0 – 9.4.2–CNA

FortiNAC9.2.0 – 9.2.7–CNA

FortiNAC9.1.0 – 9.1.9–CNA

FortiNAC8.8.0 – 8.8.11–CNA

FortiNAC8.7.0 – 8.7.6–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

fortinet (CNA)5.9CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-013