CVE-2019-17651

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 5.2.5 and below

Description The issue is related to improper neutralization of input in the description and title parameters of a Device Maintenance Schedule. This could allow a remote attacker to conduct a Stored Cross Site Scripting attack by injecting malicious JavaScript code into the description field of a Device Maintenance schedule.

Recommendations For FortiSIEM versions 5.2.5 and below, consider restricting access to the Device Maintenance Schedule feature until a patch is available, and avoid using the description field for any input that may contain malicious code.