PT-2015-3367 · Fortinet · Fortios

Publicado 2015-05-12 · Atualizado 2017-01-03 · CVE-2015-1880

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.x through 5.2.2

Description The issue is related to a cross-site scripting (XSS) vulnerability in the sslvpn login page. This vulnerability is caused by insufficient protection of the web page structure, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The exploitation of this issue may enable a remote attacker to inject arbitrary JavaScript or HTML code.

Recommendations For FortiOS versions 5.2.x through 5.2.2, update to version 5.2.3 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2018-01296

CVE-2015-1880

Produtos afetados

Fortios

Referências · 8

• https://bdu.fstec.ru/vul/2018-01296 · Nota de Segurança
• http://fortiguard.com/advisory/FG-IR-15-005 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1880 · Nota de Segurança
• http://securityfocus.com/bid/74652 · Nota
• http://securitytracker.com/id/1032262 · Nota
• http://securitytracker.com/id/1032265 · Nota
• http://securitytracker.com/id/1032261 · Nota
• http://securitytracker.com/id/1032264 · Nota