Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Fortinet Fortinet FortiOS

CVE-2021-43080
MEDIUM 4.6

At a glance

Source
NVD
EPSS
EPSS 0.44 % · percentile 38 ()
State
PUBLISHED
Published
Updated
Assigner
fortinet
NVD status
Modified

Search on…

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors.

Weaknesses (CWE)

  • CWE-79 — Improper Neutralization of Input During Web Page Generation

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:F/RL:X/RC:Xfortinet
CVSS 3.1MEDIUM 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NNVD · psirt@fortinet.com (Secondary)
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Fortinet · Fortinet FortiOSaffected FortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD