CVE-2024-27780 LOW

CVE-2024-27780

Vendor Fortinet
Product FortiSIEM
Weakness CWE-79 · XSS
Published February 11, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

2.2/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X

What the vulnerability does

01Description

Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions, 7.0 all versions, 6.7 all versions incident page may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests.

Key dates

02Disclosure timeline

February 11, 2025 CVE published
February 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-1044 Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters CVE-2024-56020 WordPress SvegliaT Buttons Plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-50548 WordPress Awesome Progress Bar plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability CVE-2023-0246 earclink ESPCMS Content cross site scripting CVE-2025-46958 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)