PT-2014-2007 · Fortinet · Fortios

William Costa · Publicado 2014-02-04 · Atualizado 2015-07-27 · CVE-2013-7181

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.0.3

Description The issue is related to a cross-site scripting vulnerability in the web interface of FortiOS, specifically in the "user/ldap user/add" endpoint. This vulnerability is caused by insufficient protection of the web page structure. It allows a remote attacker to inject arbitrary JavaScript or HTML code through the filter parameter.

Recommendations For FortiOS version 5.0.3, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "user/ldap user/add" endpoint to minimize the risk of exploitation. Avoid using the filter parameter in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2018-01304

CVE-2013-7181

Produtos afetados

Fortios

Referências · 10

• http://kb.cert.org/vuls/id/593118 · Nota
• http://secunia.com/advisories/56732 · Nota
• http://osvdb.org/102820 · Nota
• http://fortiguard.com/advisory/FG-IR-14-002 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7181 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7181 · Nota
• https://bdu.fstec.ru/vul/2018-01304 · Nota de Segurança
• http://securitytracker.com/id/1029731 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0015.html · Nota
• http://securityfocus.com/bid/65303 · Nota