PT-2019-2513 · Fortinet · Fortios

Publicado 2019-05-24 · Atualizado 2019-10-23 · CVE-2019-5586

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.0 through 5.6.10 FortiOS versions 6.0.0 through 6.0.4

Description A reflected Cross-Site-Scripting (XSS) issue in the SSL VPN web portal is related to the failure to sanitize input. This may allow an attacker to execute unauthorized malicious script code via the param parameter of the error process HTTP requests, enabling remote attackers to perform cross-site scripting attacks.

Recommendations For FortiOS versions 5.2.0 through 5.6.10, consider disabling the SSL VPN web portal until a patch is available. For FortiOS versions 6.0.0 through 6.0.4, restrict access to the error page HTTP request to minimize the risk of exploitation. As a temporary workaround, avoid using the param parameter in the affected HTTP requests until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-02356

CVE-2019-5586

Produtos afetados

Fortios

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-5586?cpeVersion=2.2 · Nota de Segurança
• http://securityfocus.com/bid/108610 · Nota
• https://fortiguard.com/psirt/FG-IR-19-034 · Nota
• https://bdu.fstec.ru/vul/2019-02356 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-5586 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5586 · Aviso do Fabricante
• https://fortiguard.com/advisory/FG-IR-19-034 · Aviso do Fabricante