CVE-2023-29183
En bref Sévérité HIGH 7.3 EPSS EPSS 1.31 % · centile 71 (2026-10-27) État PUBLISHED Publiée 2023-09-13 Mise à jour 2025-12-16 Attribuée par fortinet Statut NVD Modified Description An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R fortinet CVSS 3.1 HIGH 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.11cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.5cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.5Produits affectés Produit Versions Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.10 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.11 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.14
Références
Sources
