| Package | Affected versions | Patched versions |
|---|---|---|
| fortiportal | ≥ 4.0.0, ≤ 4.0.4≥ 4.1.0, ≤ 4.1.2≥ 4.2.0, ≤ 4.2.2≥ 5.0.0, ≤ 5.0.3≥ 5.1.0, ≤ 5.1.2≥ 5.2.0, ≤ 5.2.6≥ 5.3.0, ≤ 5.3.6≥ 6.0.0, ≤ 6.0.4 |
An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free