Lucene search

[email protected]CVE-2023-26206

HistoryFeb 15, 2024 - 2:15 p.m.

CVE-2023-26206

2024-02-1514:15:44

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-26206

cross-site scripting

fortinet

fortinac

security vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

8 High

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.0005 Low

EPSS

Percentile

16.6%

JSON

An improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs.

CPENameOperatorVersion
fortinet:fortinacfortinet fortinacle9.1.10
fortinet:fortinacfortinet fortinaceq9.1.2
fortinet:fortinacfortinet fortinaceq9.1.0
fortinet:fortinacfortinet fortinaceq9.1.3
fortinet:fortinacfortinet fortinaceq9.1.5
fortinet:fortinacfortinet fortinaceq9.1.6
fortinet:fortinacfortinet fortinaceq9.1.4
fortinet:fortinacfortinet fortinaceq9.1.9
fortinet:fortinacfortinet fortinaceq9.1.1
fortinet:fortinacfortinet fortinaceq9.1.7

CPE	Name	Operator	Version
fortinet:fortinac	fortinet fortinac	le	9.1.10
fortinet:fortinac	fortinet fortinac	eq	9.1.2
fortinet:fortinac	fortinet fortinac	eq	9.1.0
fortinet:fortinac	fortinet fortinac	eq	9.1.3
fortinet:fortinac	fortinet fortinac	eq	9.1.5
fortinet:fortinac	fortinet fortinac	eq	9.1.6
fortinet:fortinac	fortinet fortinac	eq	9.1.4
fortinet:fortinac	fortinet fortinac	eq	9.1.9
fortinet:fortinac	fortinet fortinac	eq	9.1.1
fortinet:fortinac	fortinet fortinac	eq	9.1.7

Rows per page:

1-10 of 261

References

fortiguard.com/psirt/FG-IR-23-063

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

8 High

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.0005 Low

EPSS

Percentile

16.6%

JSON

Related for CVE-2023-26206

prion1 cvelist1