Fortinet FortiOS Flaw Let Attacker Execute Malicious JavaScript Code

A excessive-severity execrable-procedure scripting (XSS) vulnerability tracked as (CVE-2023-29183) affecting several FortiOS and FortiProxy versions has been patched by Fortinet.

Additionally, the cybersecurity firm provided updates for a excessive-severity flaw in FortiWeb, tracked as  (CVE-2023-34984).

“A cyber possibility actor can exploit one in all these vulnerabilities to protect shut protect watch over of an affected machine,” CISA warns.

CVE-2023-29183 – FortiOS & FortiProxy

The vulnerability became as soon as tracked as CVE-2023-29183 (CVSS ranking of seven.3) in FortiOS and FortiProxy GUI. An deplorable neutralization of input proper thru websites technology (‘Wrong-procedure Scripting’) vulnerability exists.

“This could possibly perhaps moreover permit an authenticated attacker to trigger malicious JavaScript code execution through crafted guest management atmosphere,” Fortinet said in its advisory.

Affected Products

• FortiProxy version 7.2.0 thru 7.2.4
• FortiProxy version 7.0.0 thru 7.0.10
• FortiOS version 7.2.0 thru 7.2.4
• FortiOS version 7.0.0 thru 7.0.11
• FortiOS version 6.4.0 thru 6.4.12
• FortiOS version 6.2.0 thru 6.2.14

Patch Accessible

• FortiProxy version 7.2.5 or above
• FortiProxy version 7.0.11 or above
• FortiOS version 7.4.0 or above
• FortiOS version 7.2.5 or above
• FortiOS version 7.0.12 or above
• FortiOS version 6.4.13 or above
• FortiOS version 6.2.15 or above

CVE-2023-34984 – FortiWeb

The vulnerability became as soon as tracked as CVE-2023-34984 (CVSS ranking of seven.1) in FortiWeb. A protection mechanism failure vulnerability may possibly possibly perhaps moreover permit an attacker to bypass XSS and CSRF protection.

Affected Products

• FortiWeb version 7.2.0 thru 7.2.1
• FortiWeb version 7.0.0 thru 7.0.6
• FortiWeb 6.4, all versions
• FortiWeb 6.3, all versions

Patch Accessible

• FortiWeb version 7.2.2 or above
• FortiWeb version 7.0.7 or above

Attributable to this truth, users of Fortinet are told to boost their switches and firewalls as soon as doable.

Build told in regards to essentially the most up-to-date Cyber Safety News by following us on Google News, Linkedin, Twitter, and Facebook.