CyberCVE

CVE-2024-35280

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor

Severity
Medium 5.1
CVSS 3.1
Exploited
Not listed
EPSS
0.003
21.5th percentile
Discovered by
Third party
Vendor advisory field
Published
Jan 15, 2025
Assigned by fortinet

Description

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints

Weakness: CWE-79

Affected products

Vendor Product Category Matched by
Fortinet FortiDeceptor Threat Detection & Sandbox cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiDeceptor

Credit

Fortinet is pleased to thank Samy Younsi from NeroSwarm Deception-as-a-Service for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiDeceptor version 6.0.0 or above Upgrade to FortiDeceptor version 5.3.1 or above Upgrade to FortiDeceptor version 5.2.1 or above

References

Something wrong here?