CVE-2020-12811CWE-79CWE-80cross-site-scripting

CVE-2020-12811

Medium · published September 24, 2020

CVSS v3.1

5.3

EPSS

Percentile

56.4

In the wild

Unconfirmed

What it is

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00809 · 56.4th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published: 2020-09-24T22:15Z

Affected products (2)

Product	Versions	Fixed in
fortinet/fortianalyzer	≥ 6.2.0, ≤ 6.2.6	—
fortinet/fortimanager	≥ 6.2.0, ≤ 6.2.6	—

References (2)

https://fortiguard.fortinet.com/psirt/FG-IR-20-005 · [email protected]https://fortiguard.com/advisory/FG-IR-20-005 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

24 SEP 13:36Z
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and…
cvelistv5