Fortinet FortiSIEM Cross-Site Scripting Vulnerability in Error Page

A cross-site scripting vulnerability has been identified in Fortinet FortiSIEM versions 7.4.0, and 7.3.0 through 7.3.4. This vulnerability allows remote, unauthenticated attackers to inject arbitrary data into the application's error page, potentially leading to social engineering attacks through spoofed URL parameters.

Impact

Exploitation of this vulnerability could allow for unauthorized cross-site scripting, where an attacker could inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Fortinet FortiSIEM 7.4.1 or 7.3.5 or above, depending on their current version.