Cross-Site Scripting in Domain parameter

An authenticated user with high privileges could inject malicious scripts into the FortiSIEM web interface that execute in the browsers of other users who view the affected pages, allowing them to steal session credentials or redirect operations staff to malicious sites.

SIEM administrators and security operations center (SOC) staff who use Fortinet FortiSIEM for log aggregation and threat monitoring. The vulnerability affects all users who may view configuration pages that include the Domain parameter, such as authentication or data source configuration screens.

An attacker with administrative or high-privilege credentials injects JavaScript code into the Domain parameter of a FortiSIEM configuration page. When other users access that page through the web interface, the script executes in their browser, potentially stealing authentication tokens or performing unauthorized actions on their behalf.