CVE-2020-12816: 
FortiNAC vulnerability analysis and mitigation

An improper neutralization of input vulnerability was discovered in FortiNAC versions before 8.7.2, identified as CVE-2020-12816. The vulnerability allows remote authenticated attackers to perform stored cross-site scripting (XSS) attacks through the UserID field of Admin Users. This security issue was disclosed on September 24, 2020, and was assigned by Fortinet, Inc (NVD, CVE Mitre).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.1 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and requiring user interaction. Under CVSS v2.0, it scored 4.3 (Medium) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

The vulnerability can lead to stored cross-site scripting attacks when successfully exploited. This could potentially allow attackers to execute unauthorized code or commands in the context of the user's browser session, potentially compromising the confidentiality and integrity of the affected system (Fortiguard).

The vulnerability requires authentication for exploitation and involves user interaction. The attack can be performed remotely through the UserID field of Admin Users in the FortiNAC interface (NVD).

The vulnerability was addressed in FortiNAC version 8.7.2. Users are advised to upgrade to this version or later to mitigate the risk (Fortiguard).