PSIRTCross Site Scripting (XSS) vulnerabilities over the Management Console
Summary
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiEDR Central Manager may allow a remote authenticated attacker to perform a reflected cross site scripting attack (XSS) via injecting a malicious payload into the Management Console through various endpoints.
Affected Products
At least
FortiEDR Central Manager version 4.0.0
FortiEDR Central Manager version 5.0.0 through 5.0.3 Patch 6
FortiEDR Central Manager version 5.1.0
Solutions
Please upgrade FortiEDR Central Manager to version 5.2.0 and above,
Please upgrade FortiEDR Central Manager to version 5.0.3 Patch 7 and above.
Timeline
2022-07-05: Initial publication