CVE-2023-29183
At a glance Severity HIGH 7.3 EPSS EPSS 1.31 % · percentile 71 (2026-10-27) State PUBLISHED Published 2023-09-13 Updated 2025-12-16 Assigner fortinet NVD status Modified Description An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R fortinet CVSS 3.1 HIGH 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.11cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.5cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.5Affected products Product Versions Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.10 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.11 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.14
References
Sources
