Design/Logic Flaw

2022-11-0212:15:00

PRIOn knowledge base

www.prio-n.com

fortimanager

fortianalyzer

input neutralization

xss attack

cve-2020-9281

nvd

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.2%

JSON

An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor “protected” comment as described in CVE-2020-9281.

CPENameOperatorVersion
fortianalyzerge7.0.0
fortianalyzerle7.0.4
fortianalyzerge6.4.0
fortianalyzerle6.4.8
fortianalyzerge6.0.0
fortianalyzerle6.2.9
fortimanagerge7.0.0
fortimanagerle7.0.4
fortimanagerge6.0.0
fortimanagerle6.2.9

Name	Operator	Version
fortianalyzer	ge	7.0.0
fortianalyzer	le	7.0.4
fortianalyzer	ge	6.4.0
fortianalyzer	le	6.4.8
fortianalyzer	ge	6.0.0
fortianalyzer	le	6.2.9
fortimanager	ge	7.0.0
fortimanager	le	7.0.4
fortimanager	ge	6.0.0
fortimanager	le	6.2.9