PT-2019-2513 · Fortinet · Fortios

Published 2019-05-24 · Updated 2019-10-23 · CVE-2019-5586

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.0 through 5.6.10 FortiOS versions 6.0.0 through 6.0.4

Description A reflected Cross-Site-Scripting (XSS) issue in the SSL VPN web portal is related to the failure to sanitize input. This may allow an attacker to execute unauthorized malicious script code via the param parameter of the error process HTTP requests, enabling remote attackers to perform cross-site scripting attacks.

Recommendations For FortiOS versions 5.2.0 through 5.6.10, consider disabling the SSL VPN web portal until a patch is available. For FortiOS versions 6.0.0 through 6.0.4, restrict access to the error page HTTP request to minimize the risk of exploitation. As a temporary workaround, avoid using the param parameter in the affected HTTP requests until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-02356

CVE-2019-5586

Affected Products

Fortios

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-5586?cpeVersion=2.2 · Security Note
• https://bdu.fstec.ru/vul/2019-02356 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-5586 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5586 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-19-034 · Vendor Advisory
• http://securityfocus.com/bid/108610 · Note
• https://fortiguard.com/psirt/FG-IR-19-034 · Note