Vulnerability Details CVE-2021-26092
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.2%
CVSS Severity
CVSS v3 Score 4.7
CVSS v2 Score 4.3
Products affected by CVE-2021-26092
-
cpe:2.3:a:fortinet:fortiproxy:1.2.0
-
cpe:2.3:a:fortinet:fortiproxy:1.2.1
-
cpe:2.3:a:fortinet:fortiproxy:1.2.2
-
cpe:2.3:a:fortinet:fortiproxy:1.2.3
-
cpe:2.3:a:fortinet:fortiproxy:1.2.4
-
cpe:2.3:a:fortinet:fortiproxy:1.2.5
-
cpe:2.3:a:fortinet:fortiproxy:1.2.6
-
cpe:2.3:a:fortinet:fortiproxy:1.2.7
-
cpe:2.3:a:fortinet:fortiproxy:1.2.8
-
cpe:2.3:a:fortinet:fortiproxy:1.2.9
-
cpe:2.3:a:fortinet:fortiproxy:2.0.0
-
cpe:2.3:a:fortinet:fortiproxy:2.0.1
-
cpe:2.3:o:fortinet:fortios:5.2.10
-
cpe:2.3:o:fortinet:fortios:5.2.11
-
cpe:2.3:o:fortinet:fortios:5.2.12
-
cpe:2.3:o:fortinet:fortios:5.2.13
-
cpe:2.3:o:fortinet:fortios:5.2.14
-
cpe:2.3:o:fortinet:fortios:5.2.15
-
cpe:2.3:o:fortinet:fortios:5.4.0
-
cpe:2.3:o:fortinet:fortios:5.4.1
-
cpe:2.3:o:fortinet:fortios:5.4.10
-
cpe:2.3:o:fortinet:fortios:5.4.11
-
cpe:2.3:o:fortinet:fortios:5.4.12
-
cpe:2.3:o:fortinet:fortios:5.4.13
-
cpe:2.3:o:fortinet:fortios:5.4.2
-
cpe:2.3:o:fortinet:fortios:5.4.3
-
cpe:2.3:o:fortinet:fortios:5.4.4
-
cpe:2.3:o:fortinet:fortios:5.4.5
-
cpe:2.3:o:fortinet:fortios:5.4.6
-
cpe:2.3:o:fortinet:fortios:5.4.7
-
cpe:2.3:o:fortinet:fortios:5.4.8
-
cpe:2.3:o:fortinet:fortios:5.4.9
-
cpe:2.3:o:fortinet:fortios:5.6.0
-
cpe:2.3:o:fortinet:fortios:5.6.1
-
cpe:2.3:o:fortinet:fortios:5.6.10
-
cpe:2.3:o:fortinet:fortios:5.6.11
-
cpe:2.3:o:fortinet:fortios:5.6.12
-
cpe:2.3:o:fortinet:fortios:5.6.13
-
cpe:2.3:o:fortinet:fortios:5.6.14
-
cpe:2.3:o:fortinet:fortios:5.6.2
-
cpe:2.3:o:fortinet:fortios:5.6.3
-
cpe:2.3:o:fortinet:fortios:5.6.4
-
cpe:2.3:o:fortinet:fortios:5.6.5
-
cpe:2.3:o:fortinet:fortios:5.6.6
-
cpe:2.3:o:fortinet:fortios:5.6.7
-
cpe:2.3:o:fortinet:fortios:5.6.8
-
cpe:2.3:o:fortinet:fortios:5.6.9
-
cpe:2.3:o:fortinet:fortios:6.0.0
-
cpe:2.3:o:fortinet:fortios:6.0.1
-
cpe:2.3:o:fortinet:fortios:6.0.10
-
cpe:2.3:o:fortinet:fortios:6.0.11
-
cpe:2.3:o:fortinet:fortios:6.0.12
-
cpe:2.3:o:fortinet:fortios:6.0.2
-
cpe:2.3:o:fortinet:fortios:6.0.3
-
cpe:2.3:o:fortinet:fortios:6.0.4
-
cpe:2.3:o:fortinet:fortios:6.0.5
-
cpe:2.3:o:fortinet:fortios:6.0.6
-
cpe:2.3:o:fortinet:fortios:6.0.7
-
cpe:2.3:o:fortinet:fortios:6.0.8
-
cpe:2.3:o:fortinet:fortios:6.0.9
-
cpe:2.3:o:fortinet:fortios:6.2.0
-
cpe:2.3:o:fortinet:fortios:6.2.1
-
cpe:2.3:o:fortinet:fortios:6.2.2
-
cpe:2.3:o:fortinet:fortios:6.2.3
-
cpe:2.3:o:fortinet:fortios:6.2.4
-
cpe:2.3:o:fortinet:fortios:6.2.5
-
cpe:2.3:o:fortinet:fortios:6.2.6
-
cpe:2.3:o:fortinet:fortios:6.2.7
-
cpe:2.3:o:fortinet:fortios:6.4.0
-
cpe:2.3:o:fortinet:fortios:6.4.1
-
cpe:2.3:o:fortinet:fortios:6.4.2
-
cpe:2.3:o:fortinet:fortios:6.4.3
-
cpe:2.3:o:fortinet:fortios:6.4.4