CVE-2024-31488 - OpenCVE

An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation None

Automatable No

Technical Impact Total

Vendors	Products
Fortinet	Fortinac

No data.

No data.

References

Link	Providers
https://fortiguard.com/psirt/FG-IR-24-040

History

No history.

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2024-05-14T16:19:08.151Z

Updated: 2024-08-02T01:52:57.296Z

Reserved: 2024-04-04T12:52:41.585Z

Link: CVE-2024-31488

Vulnrichment

Updated: 2024-05-17T12:21:19.444Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T17:17:23.733

Modified: 2024-05-14T19:17:55.627

Link: CVE-2024-31488

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31488", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-04-04T12:52:41.585Z", "datePublished": "2024-05-14T16:19:08.151Z", "dateUpdated": "2024-08-02T01:52:57.296Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiNAC", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "9.4.0", "lessThanOrEqual": "9.4.3", "status": "affected"}, {"versionType": "semver", "version": "9.2.0", "lessThanOrEqual": "9.2.8", "status": "affected"}, {"versionType": "semver", "version": "9.1.0", "lessThanOrEqual": "9.1.10", "status": "affected"}, {"versionType": "semver", "version": "8.8.0", "lessThanOrEqual": "8.8.11", "status": "affected"}, {"versionType": "semver", "version": "8.7.0", "lessThanOrEqual": "8.7.6", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.2", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-05-14T16:19:08.151Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiNAC version 9.4.5 or above \nPlease upgrade to FortiNAC version 7.4.0 or above \nPlease upgrade to FortiNAC version 7.2.4 or above \n"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-24-040", "url": "https://fortiguard.com/psirt/FG-IR-24-040"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31488", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-05-17T04:00:23.122383Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "custom", "lessThanOrEqual": "9.4.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:9.2.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.2.0", "versionType": "custom", "lessThanOrEqual": "9.2.8"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:9.1.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.1.0", "versionType": "custom", "lessThanOrEqual": "9.1..10"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:8.8.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "8.8.0", "versionType": "custom", "lessThanOrEqual": "8.8.11"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:8.7.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "8.7.0", "versionType": "custom", "lessThanOrEqual": "8.7.6"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:7.2.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "custom", "lessThanOrEqual": "7.2.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:36:26.094Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:52:57.296Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-24-040", "url": "https://fortiguard.com/psirt/FG-IR-24-040", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31488", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-04-04T12:52:41.585Z", "datePublished": "2024-05-14T16:19:08.151Z", "dateUpdated": "2024-06-04T17:36:26.094Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiNAC", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "9.4.0", "lessThanOrEqual": "9.4.3", "status": "affected"}, {"versionType": "semver", "version": "9.2.0", "lessThanOrEqual": "9.2.8", "status": "affected"}, {"versionType": "semver", "version": "9.1.0", "lessThanOrEqual": "9.1.10", "status": "affected"}, {"versionType": "semver", "version": "8.8.0", "lessThanOrEqual": "8.8.11", "status": "affected"}, {"versionType": "semver", "version": "8.7.0", "lessThanOrEqual": "8.7.6", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.2", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-05-14T16:19:08.151Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiNAC version 9.4.5 or above \nPlease upgrade to FortiNAC version 7.4.0 or above \nPlease upgrade to FortiNAC version 7.2.4 or above \n"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-24-040", "url": "https://fortiguard.com/psirt/FG-IR-24-040"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31488", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-05-17T04:00:23.122383Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "custom", "lessThanOrEqual": "9.4.3"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:9.2.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.2.0", "versionType": "custom", "lessThanOrEqual": "9.2.8"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:9.1.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "9.1.0", "versionType": "custom", "lessThanOrEqual": "9.1..10"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:8.8.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "8.8.0", "versionType": "custom", "lessThanOrEqual": "8.8.11"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:8.7.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "8.7.0", "versionType": "custom", "lessThanOrEqual": "8.7.6"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:fortinet:fortinac:7.2.0:*:*:*:*:*:*:*"], "vendor": "fortinet", "product": "fortinac", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "custom", "lessThanOrEqual": "7.2.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-17T12:21:19.444Z"}, "title": "CISA ADP Vulnrichment"}]}}