Paper/Archive/CVE-2024-31488

CVE-2024-31488

Fortinet FortiNAC — An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 thr…

EPSS 1%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 63.3.633 × 2012.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiNAC9.4.0 – 9.4.3–CNA

FortiNAC9.2.0 – 9.2.8–CNA

FortiNAC9.1.0 – 9.1.10–CNA

FortiNAC8.8.0 – 8.8.11–CNA

FortiNAC8.7.0 – 8.7.6–CNA

FortiNAC7.2.0 – 7.2.2–CNA

fortinac9.4.0 – 9.4.3–CISA-ADP

fortinac9.2.0 – 9.2.8–CISA-ADP

fortinac9.1.0 – 9.1..10–CISA-ADP

fortinac8.8.0 – 8.8.11–CISA-ADP

fortinac8.7.0 – 8.7.6–CISA-ADP

fortinac7.2.0 – 7.2.2–CISA-ADP

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

fortinet (CNA)6.1CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-24-040