VYPR
← All advisories
Medium severity5.8NVD Advisory· Published Aug 19, 2021· Updated Jun 17, 2026

CVE-2021-32602

CVE-2021-32602

Description

An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value.

Affected products

3
  • Fortinet/Fortiportal2 versions
    cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*range: >=4.0.0,<=4.0.4
    • (no CPE)range: FortiPortal 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below.
  • Fortinet/FortiPortal GUIllm-create
    Range: <=6.0.4, <=5.3.6, <=5.2.6, <=5.1.2, <=5.0.3, <=4.2.2, <=4.1.2, <=4.0.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.