CVE-2021-43062

Description

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.

Reserved 2021-10-28 | Published 2022-02-02 | Updated 2024-10-22 | Assigner fortinet

Problem types

Execute unauthorized code or commands

Product status

FortiMail 7.0.1, 7.0.0, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
affected

References

fortiguard.com/advisory/FG-IR-21-185

packetstormsecurity.com/...l-7.0.1-Cross-Site-Scripting.html

cve.org (CVE-2021-43062)

nvd.nist.gov (CVE-2021-43062)

Download JSON