PT-2019-20260 · Fortinet · Fortigate+1

Publicado 2019-11-25 · Atualizado 2025-03-17 · CVE-2019-6697

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiGate versions 6.0.0 through 6.0.6 FortiGate versions 6.2.0 through 6.2.1

Description The issue is related to an Improper Neutralization of Input in the hostname parameter of a DHCP packet under the DHCP monitor page. This may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet.

Recommendations For FortiGate versions 6.0.0 through 6.0.6, update to a version outside of this range to resolve the issue. For FortiGate versions 6.2.0 through 6.2.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the DHCP monitor page to minimize the risk of exploitation. Avoid using the hostname parameter in the affected DHCP packet until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-6697

Produtos afetados

Fortigate

Fortios

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-6697 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6697 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-19-184 · Nota