PT-2020-5530 · Fortinet · Fortisiem

Published 2020-01-27 · Updated 2020-01-29 · CVE-2019-17651

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 5.2.5 and below

Description The issue is related to improper neutralization of input in the description and title parameters of a Device Maintenance Schedule. This could allow a remote attacker to conduct a Stored Cross Site Scripting attack by injecting malicious JavaScript code into the description field of a Device Maintenance schedule.

Recommendations For FortiSIEM versions 5.2.5 and below, consider restricting access to the Device Maintenance Schedule feature until a patch is available, and avoid using the description field for any input that may contain malicious code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01047

CVE-2019-17651

Affected Products

Fortisiem

References · 4

• https://fortiguard.com/psirt/FG-IR-19-197 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17651 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-17651 · Security Note