Fortinet FortiOS Improper Input Neutralization Vulnerability in Web Filtering Allowing Redirects or JavaScript Execution

A vulnerability exists in Fortinet FortiOS versions 6.4.1 and prior, as well as 6.2.9 and prior, due to improper neutralization of input during web page generation. This vulnerability may enable a remote, unauthenticated attacker to redirect users to malicious websites by sending a crafted 'Host' header, or to execute JavaScript code in the context of the victim's browser. The issue arises when the FortiGate device has web filtering and category override features enabled and configured.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing for the execution of malicious scripts in the context of the user's browser.