PT-2017-15674 · Fortinet · Fortigate+1

Publicado 2017-04-19 · Atualizado 2017-07-11 · CVE-2017-3127

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiGate versions 5.2.0 through 5.2.10

Description The issue allows an attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation. This can be exploited to load and run remote malicious Javascript in a logged-in browser.

Recommendations For Fortinet FortiGate versions 5.2.0 through 5.2.10, consider disabling the Firewall Policy Creation feature until a patch is available, or restrict access to the srcintf parameter to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-3127

Produtos afetados

Fortigate

Fortios

Referências · 5

• http://securityfocus.com/bid/98048 · Nota
• https://osv.dev/vulnerability/CVE-2017-3127 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3127 · Nota de Segurança
• http://securitytracker.com/id/1038367 · Nota
• https://fortiguard.com/psirt/FG-IR-17-017 · Aviso do Fabricante