FG-IR-20-005FortinetFirewall and VPNSeptember 21, 2020

Fortinet: HTML injection in WebUI

Medium 4.9

Description

An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field. Revised on 2026-10-13 00:00:00

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Running Fortinet devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Fortinet alerts

Details

Vendor
Fortinet
Product
FortiManager, FortiAnalyzer
CVSS score
4.9
Actively exploited
Not known at this time
Source
Fortinet PSIRT – original advisory
Published
September 21, 2020

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Fortinet advisories