CyberCVE

CVE-2024-26006

An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3

Severity
Medium 6.9
CVSS 3.1
Remote, needs privileges or user interaction what this means
Exploited
Not listed
EPSS
0.006
46.8th percentile
Discovered by
Third party
Vendor advisory field
Published
Mar 14, 2025
Assigned by fortinet

Description

An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.

Weakness: CWE-79

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Check your version Firewall / NGFW cna-assigner
Fortinet FortiProxy Check your version SASE / SSE / Secure Web cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiProxy
  • Fortinet · FortiOS

Credit

Fortinet is pleased to thank Jamie Riden from IOActive for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiProxy version 7.4.4 or above Please upgrade to FortiProxy version 7.2.10 or above Please upgrade to FortiProxy version 7.0.17 or above Please upgrade to FortiOS version 7.4.4 or above Please upgrade to FortiOS version 7.2.8 or above Please upgrade to FortiOS version 7.0.14 or above

References

Something wrong here?