CVEvulnerability

CVE-2024-23111

4.8 MEDIUM Published 2024-06-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-06-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.

Affected configurations

• fortinet fortiproxy (>= 7.0.0 < 7.0.15) • fortinet fortiproxy (>= 7.2.0 < 7.2.9) • fortinet fortiproxy (>= 7.4.0 < 7.4.3) • fortinet fortios (>= 7.0.0 < 7.0.14) • fortinet fortios (>= 7.2.0 < 7.2.8) • fortinet fortios (>= 7.4.0 < 7.4.4)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References