cve/2024/CVE-2024-33510.md

### [CVE-2024-33510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33510)
![](https://img.shields.io/static/v1?label=Product&message=FortiOS&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=FortiProxy&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=7.0.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=7.2.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=7.4.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20access%20control&color=brightgreen)

### Description

An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/afine-com/research