CVE-2021-26092
24.02.2022, 03:15
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | 1.2.0 ≤ 𝑥 ≤ 1.2.9 |
| fortinet | fortiproxy | 2.0.0 |
| fortinet | fortiproxy | 2.0.1 |
| fortinet | fortios | 5.2.10 ≤ 𝑥 ≤ 5.2.15 |
| fortinet | fortios | 5.4.0 ≤ 𝑥 ≤ 5.4.13 |
| fortinet | fortios | 5.6.0 ≤ 𝑥 ≤ 5.6.14 |
| fortinet | fortios | 6.0.0 ≤ 𝑥 ≤ 6.0.12 |
| fortinet | fortios | 6.2.0 ≤ 𝑥 ≤ 6.2.7 |
| fortinet | fortios | 6.4.0 ≤ 𝑥 ≤ 6.4.4 |
𝑥
= Vulnerable software versions