Reflected XSS in the password reset page

Summary

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Affected Products

FortiAuthenticator 6.5 all versions are not affected
FortiAuthenticator version 6.4.0 through 6.4.6
FortiAuthenticator version 6.3.0 through 6.3.3
FortiAuthenticator 6.2 all versions
FortiAuthenticator 6.1 all versions
FortiAuthenticator 6.0 all versions are not affected
FortiAuthenticator 5.5 all versions are not affected

Solutions

Please upgrade to FortiAuthenticator version 6.5.0 or above
Please upgrade to FortiAuthenticator version 6.4.7 or above
Please upgrade to FortiAuthenticator version 6.3.4 or above

Acknowledgement

Fortinet is pleased to thank Leandro Barragan from SwordBytes for reporting this vulnerability under responsible disclosure.

Timeline

2023-04-11: Initial publication