PT-2019-2514 · Fortinet · Fortios

Publicado 2019-05-24 · Atualizado 2019-08-21 · CVE-2019-5588

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.4

Description The issue is related to a lack of input sanitization in the SSL VPN web portal of the FortiOS operating system. This can be exploited by a remote attacker to perform a reflected Cross-Site Scripting (XSS) attack. The attack can be executed via the err parameter of the error process HTTP requests, allowing the attacker to run unauthorized malicious script code. The vulnerability may also be exploitable through multiple parameters of the error page HTTP request.

Recommendations For FortiOS versions 6.0.0 through 6.0.4, consider disabling the SSL VPN web portal until a patch is available to prevent exploitation. Restrict access to the error page HTTP request to minimize the risk of XSS attacks via the err parameter and other vulnerable parameters. Avoid using the err parameter in the affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-02357

CVE-2019-5588

Produtos afetados

Fortios

Referências · 7

• https://bdu.fstec.ru/vul/2019-02357 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5588 · Aviso do Fabricante
• http://securityfocus.com/bid/108618 · Nota
• https://fortiguard.com/psirt/FG-IR-19-034 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5588 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-19-034 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5588?cpeVersion=2.2 · Nota de Segurança