CVE-2024-26006
At a glance Severity MEDIUM 6.9 EPSS EPSS 0.61 % · percentile 49 (2026-10-27) State PUBLISHED Published 2025-03-14 Updated 2026-02-26 Assigner fortinet NVD status Analyzed Description An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X fortinet CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 7.0.14cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.17cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.10cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4Affected products Product Versions Fortinet · FortiProxy affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.9 ; affected 7.0.0 ≤ 7.0.16 Fortinet · FortiOS affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.0 ≤ 7.0.13 ; affected 6.4.0 ≤ 6.4.15
References
Sources
