PT-2020-22818 · Fortinet · Fortiproxy+1

Published 2020-09-16 · Updated 2025-03-17 · CVE-2019-15706

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiProxy versions 1.2.9 and below, version 2.0.0 FortiOS versions 5.6.12, 6.0.8 and below, 6.2.1 and below

Description The issue is related to an improper neutralization of input during web page generation in the SSL VPN portal, which may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).

Recommendations For FortiProxy version 2.0.0, update to a version that fixes the improper neutralization of input issue. For FortiProxy versions 1.2.9 and below, update to a version that fixes the improper neutralization of input issue. For FortiOS versions 5.6.12, 6.0.8 and below, 6.2.1 and below, update to a version that fixes the improper neutralization of input issue. As a temporary workaround, consider restricting access to the SSL VPN portal to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15706

Affected Products

Fortios

Fortiproxy

References · 5

• https://osv.dev/vulnerability/CVE-2019-15706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15706 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15706 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-19-223 · Note
• https://fortiguard.com/psirt/FG-IR-19-223 · Note