====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN650
_____________________________________________________________________

DATE                : 03/12/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running FortiGate versions prior to 6.4.2,
                                          6.2.6.

=====================================================================
https://www.fortiguard.com/psirt/FG-IR-20-068
_____________________________________________________________________


XSS vulnerability observed in Log and Report section of FortiGate


Summary

An improper neutralization of input vulnerability in the FortiGate may
allow a remote attacker to perform a stored cross site scripting attack
(XSS) via the IPS and WAF logs dashboard.


Impact

Unauthorized code execution


Affected Products

FortiGate version 6.2.5 and below.

FortiGate version 6.4.1 and below.


Solutions

Please upgrade to FortiGate version 6.4.2 or above.

Please upgrade to FortiGate version 6.2.6 or above.


Acknowledgement

Fortinet is pleased to thank Forster Chiu from CYBERGROOT LTD; Mark
Chapman of Chapman Technology Group, Inc; Wenceslas Lejeune and the SOC
team from Cheops Technology and Oğuz DOKUMACI from Oyuncusundan.com for
reporting this vulnerability under responsible disclosure.


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================