CVEFinder.io

CVE-2024-35280

🔶 medium
🔍 Scan for this CVE
Summary

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to p

Description

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints

CVSS Score
5.4
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2025-01-15
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.9% of all 321,566 vulnerabilities in our database.

#247,909
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jan 15, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-02-04
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-79

📦 Affected Products 2

Vendor Product Status Affected Versions
fortinet fortideceptor Affected
≥ 3.0.0 < 5.2.1
fortinet fortideceptor Affected
v5.3.0

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-24-010
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-25690 🔶 medium 4.3 0.1 An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDec... 2026-05-12
CVE-2026-25689 🔶 medium 6.5 0.0 An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDec... 2026-03-10
CVE-2024-45326 🔶 medium 4.3 0.1 An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all... 2025-01-14
CVE-2022-27487 ⚠️ high 8.8 1.0 A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2... 2023-04-11
CVE-2023-26209 ℹ️ low 3.7 7.3 A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and ... 2023-03-09
CVE-2022-30305 ℹ️ low 3.7 0.2 An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1... 2022-12-06
These CVEs affect the same products