FortiADC vulnerabilities

Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.

Fortinet FortiADC (versions 7.4.0, 7.2, 7.1, 7.0, and 6.2) contains an exposure of sensitive information to an unauthorized actor vulnerability. An admin with read-only permission may obtain the external resources password via the product logs.

An out-of-bounds write vulnerability (CWE-787) in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, and 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.

Fortinet FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, 7.0 all versions, and 6.2 all versions have an exposure of sensitive information to an unauthorized actor vulnerability. An authenticated attacker can obtain sensitive data via crafted HTTP or HTTPS requests.