PT-2017-3713 · Fortinet · Fortios

Patryk_Bogdan · Publicado 2017-07-18 · Atualizado 2017-09-14 · CVE-2017-3132

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.6.0 and earlier

Description: A Cross-Site Scripting issue allows attackers to execute unauthorized code or commands via the action input during the activation of a FortiToken. The vulnerability is caused by insufficient protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary JavaScript or HTML code during FortiToken activation using the action parameter.

Recommendations: For FortiOS versions 5.6.0 and earlier, consider disabling the FortiToken activation feature until a patch is available to prevent exploitation. Restrict access to the vulnerable web interface to minimize the risk of remote code injection. Avoid using the action parameter in the affected web interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2018-01283

CVE-2017-3132

Produtos afetados

Fortios

Referências · 9

• 🔥 https://exploit-db.com/exploits/42388 · Exploit
• https://fortiguard.com/psirt/FG-IR-17-104 · Nota
• https://securityfocus.com/bid/100009 · Nota
• https://osv.dev/vulnerability/CVE-2017-3132 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3132 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-01283 · Nota de Segurança
• http://securityfocus.com/bid/100009 · Nota
• http://securitytracker.com/id/1039020 · Nota
• https://fortiguard.com/advisory/FG-IR-17-104 · Aviso do Fabricante