CVE-2021-26092

Description

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.

Reserved 2021-01-25 | Published 2022-02-24 | Updated 2024-10-22 | Assigner fortinet

Problem types

Execute unauthorized code or commands

Product status

FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1
affected

References

fortiguard.com/psirt/FG-IR-20-199

cve.org (CVE-2021-26092)

nvd.nist.gov (CVE-2021-26092)

Download JSON