CVE-2021-43080: 
FortiOS vulnerability analysis and mitigation

An improper neutralization of input during web page generation vulnerability (CVE-2021-43080) was discovered in FortiOS versions 7.2.0, 6.4.0 through 6.4.9, and 7.0.0 through 7.0.5. The vulnerability allows an authenticated attacker to perform a stored cross-site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 Base Score of 5.4 (MEDIUM) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Fortinet assigned it a slightly lower score of 4.6 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (NVD).

The vulnerability affects the confidentiality and integrity of the system with low impact, while having no effect on availability. The successful exploitation could allow attackers to inject and execute malicious scripts in the context of other users' sessions (NVD).

The vulnerability requires network access (AV:N) with low attack complexity (AC:L). It needs low privileges (PR:L) and user interaction (UI:R) for successful exploitation. The scope is changed (S:C) according to NIST's assessment (NVD).

Users should upgrade to FortiOS version 7.2.1, 6.4.10, or 7.0.6 or later versions to address this vulnerability (Fortinet Advisory).