CVE-2021-36188

MEDIUM

FortiWeb < 6.2.5 - Cross-Site Scripting via GET Parameters in Login and Error Handlers

Title source: llm

Description

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-21-118

Scores

CVSS v3 6.1

EPSS 0.0037

EPSS Percentile 59.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

fortinet/fortiweb 6.0.0 - 6.2.5

Published Dec 08, 2021

Tracked Since Feb 18, 2026