Vulnerability · Published Jun 11, 2024 · Assigned by fortinet
CVE-2024-23111
Medium 6.2
In plain English
A medium-severity cross-site scripting in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Official description
An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.4.0 – through 7.4.27.2.0 – through 7.2.67.0.0 – through 7.0.13 |
| Fortinet | FortiProxy | 7.4.0 – through 7.4.27.2.0 – through 7.2.87.0.0 – through 7.0.14 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R