CVE-2019-16154

Name of the Vulnerable Software and Affected Versions FortiAuthenticator version 6.0.0

Description The issue is related to the lack of input data sanitization in the FortiAuthenticator web interface. This can be exploited by a remote attacker to perform cross-site scripting attacks (XSS). Specifically, an unauthenticated user may be able to perform an XSS attack via a parameter of the logon page.

Recommendations For FortiAuthenticator version 6.0.0, consider restricting access to the logon page until a patch is available. As a temporary workaround, avoid using the vulnerable parameter in the logon page to minimize the risk of exploitation.