CVE-2023-22637

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

Score

CVSS 3.1 9.0 Critical

Status

Modified - psirt@fortinet.com

Published

2023-05-03

Last modified

2024-10-23

Weaknesses

CWE-79

Affected products

• Fortinac (Fortinet)
• Fortinac-f (Fortinet)

References

• https://fortiguard.com/psirt/FG-IR-23-013