FortiSIEM vulnerabilities

An OS Command Injection vulnerability in Fortinet FortiSIEM allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Affects multiple versions from 4.7 to 7.3.1.

A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.

A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.

An XSS vulnerability in Fortinet FortiSIEM allows an attacker to inject malicious JavaScript code into a web page. The issue affects multiple FortiSIEM versions from 6.4 to 7.4.0.

FortiSIEM versions 7.2.0 through 7.2.2, 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3, and 6.2 (all versions) contain a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An authenticated attacker can perform a stored XSS attack via crafted HTTP requests.