CVE-2024-52967

An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-24-211	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*

History

03 Feb 2025, 21:59

Type	Values Removed	Values Added
First Time		Fortinet Fortinet fortiportal
Summary		(es) Una neutralización incorrecta de las etiquetas HTML relacionadas con Script en una página web (XSS básico) en Fortinet FortiPortal 6.0.0 a 6.0.14 permite a un atacante ejecutar código o comandos no autorizados a través de la inyección HTML.
CWE		CWE-79
References	~~() https://fortiguard.fortinet.com/psirt/FG-IR-24-211 -~~	() https://fortiguard.fortinet.com/psirt/FG-IR-24-211 - Vendor Advisory
CPE		cpe:2.3:a:fortinet:fortiportal::::::::

14 Jan 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-14 14:15

Updated : 2025-02-03 21:59

NVD link : CVE-2024-52967

Mitre link : CVE-2024-52967

CVE.ORG link : CVE-2024-52967

JSON object : View

Products Affected

fortinet

fortiportal

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-52967", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2025-01-14T14:15:33.967", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-211", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-80"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection."}, {"lang": "es", "value": "Una neutralizaci\u00f3n incorrecta de las etiquetas HTML relacionadas con Script en una p\u00e1gina web (XSS b\u00e1sico) en Fortinet FortiPortal 6.0.0 a 6.0.14 permite a un atacante ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de la inyecci\u00f3n HTML."}], "lastModified": "2025-02-03T21:59:09.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CE5BD60-C70A-492C-BC35-5F568A4F180D", "versionEndExcluding": "6.0.15", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}