An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.
References
| Link | Resource |
|---|---|
| https://fortiguard.com/psirt/FG-IR-23-013 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 May 2023, 20:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fortinet:fortinac-f:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:* |
|
| CWE | CWE-79 | |
| First Time |
Fortinet fortinac
Fortinet fortinac-f Fortinet |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
| References | (MISC) https://fortiguard.com/psirt/FG-IR-23-013 - Vendor Advisory |
03 May 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-03 22:15
Updated : 2023-11-07 04:07
NVD link : CVE-2023-22637
Mitre link : CVE-2023-22637
CVE.ORG link : CVE-2023-22637
JSON object : View
Products Affected
fortinet
- fortinac
- fortinac-f
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')