CVE-2021-43062 EXPLOIT
6.1
MEDIUM · CVSS 3.1 · EPSS 12.9% (pctl 96)
Patch early
A public exploit exists.
Description
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.
Scoring
| CVSS | 6.1 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 12.94% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-02-02 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| fortinet | fortimail |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS) | 2022-02-18 |
References
→ the Explorer · watch your stack · NVD