FORTINET Security Advisory
Published Date: Not specified
Advisory Summary
🛡️ 🔎 Title: HTML injection in WebUI (XSS risk in FortiManager / FortiAnalyzer)
⚠️ Alarms — What’s the issue?
FortiManager and FortiAnalyzer WebUI are affected by an HTML/script neutralization flaw, where an attacker could trigger a cross-site scripting (XSS) condition by abusing the Identify Provider name field.
🧩 Impact — Why it matters
With successful exploitation, an attacker may be able to execute malicious scripts in the context of the affected WebUI session (e.g., session-related actions, impersonation workflows, or UI redressing), depending on user permissions and deployment exposure.
- Type: Improper neutralization of script-related HTML tags
- Attack surface: Identify Provider name field in WebUI
- CVSSv3: 4.9 (moderate severity, but still relevant for exposed/admin-facing consoles)
✅ Actionable — What market professionals should do now
1. Check your FortiManager/FortiAnalyzer versions against the PSIRT guidance for FG-IR-20-005 and plan remediation promptly.
2. Apply the vendor’s fixed releases / mitigations as instructed by Fortinet PSIRT.
3. Audit Identify Provider configurations: look for unexpected HTML/script-like payloads in any provider “name” values.
4. Harden access paths to management interfaces: restrict admin WebUI exposure (VPN/bastion/allowlists), reduce internet reachability.
5. Monitor for suspicious UI behavior around identity/provider management actions and WebUI logs after changes.
🔐 Security operations guidance
If you have change-control windows, prioritize remediation for installations where the WebUI is reachable by semi-trusted users, third-party administrators, or less-trusted networks.
ℹ️
Reference: Vendor Advisory