5.4med
CVE-2017-14186Nuclei template
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web por…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.7%
percentile 90%
Public exploits
0
none known · Nuclei check
Summary
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
3.72% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
Exploits and detections
- Nuclei template FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting · nuclei detection template
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Fortinet, Inc. FortiOS
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
- Fortinet (RSS, critical only)
References
- securitytracker.com /id/1039891 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/101955 · vdb-entry, x_refsource_BID, x_transferred
- fortiguard.com /advisory/FG-IR-17-242 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-14186
- NVD: CVE-2017-14186
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.