PT-2021-30879 · Fortinet · Fortios

Published 2021-09-07 · Updated 2025-07-23 · CVE-2019-16151

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4.1 and below FortiOS versions 6.2.9 and below

Description The issue allows a remote unauthenticated attacker to either redirect users to malicious websites via a crafted Host header or to execute JavaScript code in the victim's browser context. This occurs when the FortiGate has web filtering and category override enabled or configured.

Recommendations For FortiOS versions 6.4.1 and below, update to a version above 6.4.1 to resolve the issue. For FortiOS versions 6.2.9 and below, update to a version above 6.2.9 to resolve the issue. As a temporary workaround, consider disabling web filtering and category override on the FortiGate until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16151

Affected Products

Fortios

References · 9

• https://fortiguard.com/advisory/FG-IR-19-301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16151 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16151 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16151 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-19-301 · Note
• https://t.me/cvedetector/20817 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-19-301 · Note
• https://t.me/cveNotify/130007 · Telegram Post
• https://t.me/cvetracker/19626 · Telegram Post