Detections
Analytics
Fortinet FortiOS 5.2.x < 5.2.3 Multiple XSS
medium Nessus Plugin ID 88841
Language:
Synopsis
The remote host is affected by multiple cross-site scripting vulnerabilities.Description
The remote FortiGate device is running a version of FortiOS that is 5.2.x prior to 5.2.3. It is, therefore, affected by multiple cross-site scripting vulnerabilities :- Multiple cross-site scripting vulnerabilities exists due to improper validation of user-supplied input to the user group and vpn template menus. An attacker can exploit these vulnerabilities, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2014-8616)
- A cross-site scripting vulnerability exists in the sslvpn login page due to improper validation of user-supplied input. An attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2015-1880)
Solution
Upgrade to Fortinet FortiOS 5.2.3 or later.See Also
Plugin Details
Severity: Medium
ID: 88841
File Name: fortios_FG-IR-15-005.nasl
Version: 1.5
Type: local
Family: Firewalls
Published: 2/18/2016
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/o:fortinet:fortios
Required KB Items: Host/Fortigate/model, Host/Fortigate/version
Exploit Ease: No known exploits are available
Patch Publication Date: 2/25/2015
Vulnerability Publication Date: 2/25/2015
Reference Information
CVE: CVE-2014-8616, CVE-2015-1880