Fortinet FortiProxy and FortiOS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the SSL VPN portal of Fortinet FortiProxy versions 2.0.0, 1.2.9 and below, as well as Fortinet FortiOS versions 6.2.1 and below, 6.0.8 and below, and 5.6.12. This vulnerability arises from improper input neutralization during web page generation, potentially allowing remote authenticated attackers to inject malicious scripts that are stored and executed in the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.