PT-2020-1570 · Fortinet · Fortiauthenticator

Published 2020-01-07 · Updated 2020-01-14 · CVE-2019-16154

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiAuthenticator version 6.0.0

Description The issue is related to the lack of input data sanitization in the FortiAuthenticator web interface. This can be exploited by a remote attacker to perform cross-site scripting attacks (XSS). Specifically, an unauthenticated user may be able to perform an XSS attack via a parameter of the logon page.

Recommendations For FortiAuthenticator version 6.0.0, consider restricting access to the logon page until a patch is available. As a temporary workaround, avoid using the vulnerable parameter in the logon page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00580

CVE-2019-16154

Affected Products

Fortiauthenticator

References · 6

• https://fortiguard.com/advisory/FG-IR-19-104 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00580 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16154 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020010803 · Note
• https://fortiguard.com/psirt/FG-IR-19-104 · Note