FortiNAC - Stored XSS triggering RCE via license key forgery

2023-05-0300:00:00

FortiGuard Labs

www.fortiguard.com

fortinac

vulnerability

stored xss

rce

license key forgery

cwe-79

input neutralization

web page generation

remote code execution

crafted licenses

license management

software

0.001 Low

EPSS

Percentile

51.3%

JSON

An improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability [CWE-79] in FortiNAC License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

CPENameOperatorVersion
fortinaceq9.4.2
fortinaceq9.4.1
fortinaceq9.4.0
fortinaceq9.2.8
fortinaceq9.2.7
fortinaceq9.2.6
fortinaceq9.2.5
fortinaceq9.2.4
fortinaceq9.2.3
fortinaceq9.2.2

Name	Operator	Version
fortinac	eq	9.4.2
fortinac	eq	9.4.1
fortinac	eq	9.4.0
fortinac	eq	9.2.8
fortinac	eq	9.2.7
fortinac	eq	9.2.6
fortinac	eq	9.2.5
fortinac	eq	9.2.4
fortinac	eq	9.2.3
fortinac	eq	9.2.2

Rows per page:

1-10 of 421

0.001 Low

EPSS

Percentile

51.3%

JSON

Related for FG-IR-23-013