This vulnerability involves improper neutralization of input during web page generation in Fortinet FortiSOAR PaaS and on-premise versions 7.3 to 7.6.3. Authenticated remote attackers can exploit this stored cross-site scripting (XSS) flaw by sending crafted HTTP requests, potentially leading to escalation of privilege within the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges at the level of an authenticated user, user interaction required, unchanged scope, low confidentiality and integrity impact, no availability impact, and high exploit code maturity with an official fix available.

The vulnerability allows an authenticated remote attacker to perform stored XSS attacks, which may enable escalation of privilege within the FortiSOAR environment. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

An official fix is available for this vulnerability. Users should apply the vendor-provided patches for FortiSOAR versions 7.3 through 7.6.3 to remediate the issue. Since this is not a cloud service, remediation depends on the user applying the patch. No additional mitigation steps are indicated by the vendor advisory.