PT-2019-20260 · Fortinet · Fortigate+1

Published 2019-11-25 · Updated 2025-03-17 · CVE-2019-6697

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiGate versions 6.0.0 through 6.0.6 FortiGate versions 6.2.0 through 6.2.1

Description The issue is related to an Improper Neutralization of Input in the hostname parameter of a DHCP packet under the DHCP monitor page. This may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet.

Recommendations For FortiGate versions 6.0.0 through 6.0.6, update to a version outside of this range to resolve the issue. For FortiGate versions 6.2.0 through 6.2.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the DHCP monitor page to minimize the risk of exploitation. Avoid using the hostname parameter in the affected DHCP packet until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-6697

Affected Products

Fortigate

Fortios

References · 3

• https://osv.dev/vulnerability/CVE-2019-6697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6697 · Security Note
• https://fortiguard.com/advisory/FG-IR-19-184 · Note