Vulnerability Description
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortimail | >= 6.2.0, < 6.2.8 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/166055/Fortinet-Fortimail-7.0.1-Cross-Site-ExploitThird Party AdvisoryVDB Entry
- https://fortiguard.com/advisory/FG-IR-21-185Vendor Advisory
- http://packetstormsecurity.com/files/166055/Fortinet-Fortimail-7.0.1-Cross-Site-ExploitThird Party AdvisoryVDB Entry
- https://fortiguard.com/advisory/FG-IR-21-185Vendor Advisory
FAQ
What is CVE-2021-43062?
CVE-2021-43062 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 a...
How severe is CVE-2021-43062?
CVE-2021-43062 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43062?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortimail.