CVE-2020-12811: 
Fortinet FortiManager vulnerability analysis and mitigation

An improper neutralization of script-related HTML tags vulnerability was identified in FortiManager versions 6.2.0 through 6.2.3 and FortiAnalyzer versions 6.2.0 through 6.2.3. This cross-site scripting (XSS) vulnerability, tracked as CVE-2020-12811, was discovered and reported in May 2020, with official disclosure occurring on September 18, 2020. The vulnerability specifically affects the Identity Provider name field in the GUI component of these Fortinet products (Fortiguard PSIRT, MITRE CVE).

The vulnerability is classified with a CVSS v3 score of 5.3, indicating a medium severity level. The issue stems from inadequate sanitization of script-related HTML tags in web pages, specifically in the Identity Provider name field of the affected products' GUI interface (Fortiguard PSIRT).

When successfully exploited, this vulnerability allows attackers to execute unauthorized code or commands through cross-site scripting attacks. This could potentially lead to the compromise of user sessions and unauthorized access to the affected systems (Fortiguard PSIRT, CERT-FR).

At the time of initial disclosure, no immediate patches were available. Users were advised to upgrade to FortiAnalyzer and FortiManager versions 6.4.0 or later to address this vulnerability (CERT-FR).