exploitDog

CVE-2021-41015

Опубликовано: 08 дек. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler

Ссылки

https://fortiguard.com/advisory/FG-IR-21-139
Patch
Vendor Advisory
https://fortiguard.com/advisory/FG-IR-21-139
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00545

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-442w-3vhj-m8rc

github

около 4 лет назад

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler

EPSS

Процентиль: 67%

0.00545

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79