Lucene search

[email protected]CVE-2021-32597

HistoryAug 06, 2021 - 11:15 a.m.

CVE-2021-32597

2021-08-0611:15:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-32597

fortimanager

fortianalyzer

stored xss

cwe-79

remote attack

input neutralization

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

28.1%

JSON

Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.

CPENameOperatorVersion
fortinet:fortimanagerfortinet fortimanagerlt6.4.6
fortinet:fortianalyzerfortinet fortianalyzerlt6.4.6
fortinet:fortianalyzerfortinet fortianalyzerlt7.0.1
fortinet:fortimanagerfortinet fortimanagerlt7.0.1
fortinet:fortianalyzerfortinet fortianalyzerlt6.2.8
fortinet:fortimanagerfortinet fortimanagerlt6.2.8

CPE	Name	Operator	Version
fortinet:fortimanager	fortinet fortimanager	lt	6.4.6
fortinet:fortianalyzer	fortinet fortianalyzer	lt	6.4.6
fortinet:fortianalyzer	fortinet fortianalyzer	lt	7.0.1
fortinet:fortimanager	fortinet fortimanager	lt	7.0.1
fortinet:fortianalyzer	fortinet fortianalyzer	lt	6.2.8
fortinet:fortimanager	fortinet fortimanager	lt	6.2.8

References

fortiguard.com/advisory/FG-IR-21-054

Social References

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

28.1%

JSON

Related for CVE-2021-32597

cnvd1 fortinet1 prion1