CVE-2021-43080

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors.

Reserved 2021-10-28 | Published 2022-09-06 | Updated 2024-10-22 | Assigner fortinet

Problem types

Execute unauthorized code or commands

Product status

FortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0
affected

References

fortiguard.com/psirt/FG-IR-21-222

cve.org (CVE-2021-43080)

nvd.nist.gov (CVE-2021-43080)

Download JSON