PT-2014-2007 · Fortinet · Fortios

William Costa · Published 2014-02-04 · Updated 2015-07-27 · CVE-2013-7181

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.0.3

Description The issue is related to a cross-site scripting vulnerability in the web interface of FortiOS, specifically in the "user/ldap user/add" endpoint. This vulnerability is caused by insufficient protection of the web page structure. It allows a remote attacker to inject arbitrary JavaScript or HTML code through the filter parameter.

Recommendations For FortiOS version 5.0.3, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "user/ldap user/add" endpoint to minimize the risk of exploitation. Avoid using the filter parameter in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01304

CVE-2013-7181

Affected Products

Fortios

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2013-7181 · Security Note
• https://bdu.fstec.ru/vul/2018-01304 · Security Note
• http://kb.cert.org/vuls/id/593118 · Note
• http://secunia.com/advisories/56732 · Note
• http://osvdb.org/102820 · Note
• http://fortiguard.com/advisory/FG-IR-14-002 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7181 · Note
• http://securitytracker.com/id/1029731 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0015.html · Note
• http://securityfocus.com/bid/65303 · Note