VYPR
← All advisories
Medium severity4.7NVD Advisory· Published Feb 24, 2022· Updated Jun 17, 2026

CVE-2021-26092

CVE-2021-26092

Description

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.

Affected products

7
  • Fortinet/Fortiproxy5 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=1.2.0,<=1.2.9
    • cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*
    • (no CPE)range: 1.2.0 through 1.2.9, 2.0.0 through 2.0.1
    • (no CPE)range: FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1
  • Fortinet/Fortios2 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=5.2.10,<=5.2.15
    • (no CPE)range: 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.