PT-2017-3713 · Fortinet · Fortios

Patryk_Bogdan · Published 2017-07-18 · Updated 2017-09-14 · CVE-2017-3132

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.6.0 and earlier

Description: A Cross-Site Scripting issue allows attackers to execute unauthorized code or commands via the action input during the activation of a FortiToken. The vulnerability is caused by insufficient protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary JavaScript or HTML code during FortiToken activation using the action parameter.

Recommendations: For FortiOS versions 5.6.0 and earlier, consider disabling the FortiToken activation feature until a patch is available to prevent exploitation. Restrict access to the vulnerable web interface to minimize the risk of remote code injection. Avoid using the action parameter in the affected web interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01283

CVE-2017-3132

Affected Products

Fortios

References · 9

• 🔥 https://exploit-db.com/exploits/42388 · Exploit
• https://osv.dev/vulnerability/CVE-2017-3132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3132 · Security Note
• https://bdu.fstec.ru/vul/2018-01283 · Security Note
• https://fortiguard.com/advisory/FG-IR-17-104 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-17-104 · Note
• https://securityfocus.com/bid/100009 · Note
• http://securityfocus.com/bid/100009 · Note
• http://securitytracker.com/id/1039020 · Note