Reflected Cross Site Scripting (XSS) in error page

An attacker could trick a FortiSIEM administrator into clicking a malicious link that steals session cookies or credentials, potentially allowing unauthorized access to your security monitoring system and the ability to view or manipulate log data and alerts.

This affects Fortinet FortiSIEM administrators and security operations staff who use the web interface for log analysis, alerting, and incident investigation. Organizations using FortiSIEM as a central security information and event management (SIEM) platform need to protect against credential theft.

The attacker sends a phishing email or message containing a crafted FortiSIEM URL with JavaScript code embedded in a URL parameter. When a FortiSIEM user clicks the link, the error page reflects the malicious code back to the browser without validation, executing the attacker's script in the user's session.