CVE-2023-37933

CVE-2023-37933 is a cross-site scripting (XSS) vulnerability stemming from improper neutralization of input during web page generation (CWE-79) in the FortiADC GUI. It affects FortiADC GUI version 7.4.0, versions 7.2.0 through 7.2.1, and all versions before 7.1.3. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low complexity, no privileges required, and potential for high confidentiality, integrity, and availability impacts given user interaction.

An authenticated attacker can exploit this vulnerability by sending crafted HTTP or HTTPS requests to the FortiADC GUI, enabling an XSS attack. Although the CVSS vector specifies no privileges required (PR:N), the vulnerability description confirms that authentication is necessary. Successful exploitation allows the attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise depending on user privileges.

For mitigation details, refer to the FortiGuard advisory FG-IR-23-216 at https://fortiguard.com/psirt/FG-IR-23-216, which provides guidance on patches and workarounds.