PT-2016-3274 · Fortinet · Fortios

Javier Nieto · Published 2016-04-08 · Updated 2016-04-14 · CVE-2016-3978

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.0.x through 5.0.12 FortiOS versions 5.2.x through 5.2.2 FortiOS versions 5.4.x before 5.4.0

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the redirect parameter to "login". This is due to insufficient protection of the web page structure, which may allow an attacker to inject arbitrary JavaScript or HTML code.

Recommendations For FortiOS versions 5.0.x through 5.0.12, update to version 5.0.13 or later. For FortiOS versions 5.2.x through 5.2.2, update to version 5.2.3 or later. For FortiOS versions 5.4.x before 5.4.0, update to version 5.4.0 or later. As a temporary workaround, consider restricting access to the "login" endpoint to minimize the risk of exploitation. Avoid using the redirect parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01292

CVE-2016-3978

Affected Products

Fortios

References · 7

• https://osv.dev/vulnerability/CVE-2016-3978 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3978 · Security Note
• http://fortiguard.com/advisory/fortios-open-redirect-vulnerability · Vendor Advisory
• http://seclists.org/fulldisclosure/2016/Mar/68 · Note
• https://seclists.org/fulldisclosure/2016/Mar/68 · Note
• http://securitytracker.com/id/1035332 · Note