Stored Cross-site scripting in log viewer

Summary

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests.

Affected Products

FortiWAN 4.5.8 and below.

Solutions

Upgrade to FortiWAN 4.5.9 or above

Acknowledgement

Internally discovered by Giuseppe Cocomazzi of Fortinet PSIRT.

Timeline

2022-04-05: Initial publication