PT-2015-3367 · Fortinet · Fortios

Published 2015-05-12 · Updated 2017-01-03 · CVE-2015-1880

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.x through 5.2.2

Description The issue is related to a cross-site scripting (XSS) vulnerability in the sslvpn login page. This vulnerability is caused by insufficient protection of the web page structure, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The exploitation of this issue may enable a remote attacker to inject arbitrary JavaScript or HTML code.

Recommendations For FortiOS versions 5.2.x through 5.2.2, update to version 5.2.3 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01296

CVE-2015-1880

Affected Products

Fortios

References · 8

• https://bdu.fstec.ru/vul/2018-01296 · Security Note
• http://fortiguard.com/advisory/FG-IR-15-005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1880 · Security Note
• http://securityfocus.com/bid/74652 · Note
• http://securitytracker.com/id/1032262 · Note
• http://securitytracker.com/id/1032265 · Note
• http://securitytracker.com/id/1032261 · Note
• http://securitytracker.com/id/1032264 · Note