PT-2017-15674 · Fortinet · Fortigate+1

Published 2017-04-19 · Updated 2017-07-11 · CVE-2017-3127

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiGate versions 5.2.0 through 5.2.10

Description The issue allows an attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation. This can be exploited to load and run remote malicious Javascript in a logged-in browser.

Recommendations For Fortinet FortiGate versions 5.2.0 through 5.2.10, consider disabling the Firewall Policy Creation feature until a patch is available, or restrict access to the srcintf parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-3127

Affected Products

Fortigate

Fortios

References · 5

• https://osv.dev/vulnerability/CVE-2017-3127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3127 · Security Note
• https://fortiguard.com/psirt/FG-IR-17-017 · Vendor Advisory
• http://securityfocus.com/bid/98048 · Note
• http://securitytracker.com/id/1038367 · Note