Lucene search

FortiGuard LabsFG-IR-21-114

HistoryDec 07, 2021 - 12:00 a.m.

FortiWLM - stored cross-site scripting in hotspot profile controller

2021-12-0700:00:00

FortiGuard Labs

www.fortiguard.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

29.4%

JSON

An improper neutralization of input during web page generation vulnerability (‘Cross-site Scripting’) [CWE-79] in FortiWLM may allow an authenticated attacker to perform a stored cross site scripting attack (XSS) via storing malicious payloads and trigger the attack on victim’s client via various endpoints.

CPENameOperatorVersion
fortiwlmeq8.6.1
fortiwlmeq8.6.0
fortiwlmeq8.5.4
fortiwlmeq8.5.3
fortiwlmeq8.5.2
fortiwlmeq8.5.1
fortiwlmeq8.5.0
fortiwlmeq8.4.2
fortiwlmeq8.4.1
fortiwlmeq8.4.0

Name	Operator	Version
fortiwlm	eq	8.6.1
fortiwlm	eq	8.6.0
fortiwlm	eq	8.5.4
fortiwlm	eq	8.5.3
fortiwlm	eq	8.5.2
fortiwlm	eq	8.5.1
fortiwlm	eq	8.5.0
fortiwlm	eq	8.4.2
fortiwlm	eq	8.4.1
fortiwlm	eq	8.4.0

Rows per page:

1-10 of 141

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

29.4%

JSON

Related for FG-IR-21-114