Fortinet has launched patches for a high-severity cross-site scripting (XSS) vulnerability impacting a number of FortiOS and FortiProxy variations.
Tracked as CVE-2023-29183 (CVSS rating of seven.3), the security defect is described as an “improper neutralization of enter throughout net web page era”.
Profitable exploitation of the bug, Fortinet explains in an advisory, might permit an authenticated attacker to make use of crafted visitor administration settings to set off the execution of malicious JavaScript code.
Recognized by Fortinet’s CSE crew, the flaw impacts FortiProxy variations 7.0.x and seven.2.x, and FortiOS variations 6.2.x, 6.4.x, 7.0.x, and seven.2.x.
Fortinet has launched FortiProxy variations 7.0.11 and seven.2.5, and FortiOS variations 6.2.15, 6.4.13, 7.0.12, 7.2.5, and seven.4.0 to handle this subject.
The cybersecurity firm additionally launched patches for a high-severity subject in its net software firewall and API safety resolution FortiWeb.
Tracked as CVE-2023-34984 (CVSS rating of seven.1), the problem may permit an attacker to bypass current XSS and cross-site request forgery (CSRF) protections, the corporate explains.
Based on Fortinet, the bug impacts FortiWeb variations 6.3, 6.4, 7.0.x, and seven.2.x, and was addressed with the discharge of FortiWeb variations 7.0.7 and seven.2.2.
Fortinet customers are suggested to replace their firewalls and switches as quickly as potential. Whereas the corporate makes no point out of any of those vulnerabilities being exploited in assaults, flaws in Fortinet home equipment have been focused within the wild to achieve entry to enterprise networks.
The US Cybersecurity and Infrastructure Safety Company (CISA) warns that exploitation of those bugs may result in full system compromise and advises directors to evaluate Fortinet’s advisories and apply the required updates.
“A cyber menace actor can exploit considered one of these vulnerabilities to take management of an affected system,” CISA notes.
