A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/166055/Fortinet-Fortimail-7.0.1-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://fortiguard.com/advisory/FG-IR-21-185 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Mar 2022, 16:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/166055/Fortinet-Fortimail-7.0.1-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry |
18 Feb 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Feb 2022, 15:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | |
| First Time |
Fortinet
Fortinet fortimail |
|
| CWE | CWE-79 | |
| References | (CONFIRM) https://fortiguard.com/advisory/FG-IR-21-185 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
02 Feb 2022, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-02 11:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-43062
Mitre link : CVE-2021-43062
CVE.ORG link : CVE-2021-43062
JSON object : View
Products Affected
fortinet
- fortimail
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')