PT-2019-3398 · Fortinet · Fortinac

Publicado 2019-07-16 · Atualizado 2019-08-26 · CVE-2019-5594

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiNAC versions 8.3.0 through 8.3.6 Fortinet FortiNAC version 8.5.0

Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, in the admin webUI of Fortinet FortiNAC. This may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI. The vulnerability can be exploited by a remote attacker to perform cross-site scripting attacks.

Recommendations For Fortinet FortiNAC versions 8.3.0 through 8.3.6, consider disabling the search field in the webUI as a temporary workaround until a patch is available. For Fortinet FortiNAC version 8.5.0, consider restricting access to the admin webUI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-03548

CVE-2019-5594

Produtos afetados

Fortinac

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-5594 · Aviso do Fabricante
• https://fortiguard.com/advisory/FG-IR-19-140 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-19-140 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5594 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03548 · Nota de Segurança