CVE-2019-5586

Опубликовано: 04 июн. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.

Ссылки

http://www.securityfocus.com/bid/108610
https://fortiguard.com/advisory/FG-IR-19-034
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/108610
https://fortiguard.com/advisory/FG-IR-19-034
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Версия от 5.2.0 (включая) до 6.0.4 (включая)

EPSS

Процентиль: 50%

0.00264

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-h6wj-gcf6-rxw5

github

больше 3 лет назад

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.

BDU:2019-02356