4.7med
CVE-2018-13380Nuclei template
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
62.5%
percentile 99%
Public exploits
0
none known · Nuclei check
Summary
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
62.47% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Nuclei template Fortinet FortiOS - Cross-Site Scripting · nuclei detection template
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Fortinet Fortinet FortiOS and FortiProxy
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
- Fortinet (RSS, critical only)
References
- fortiguard.com /advisory/FG-IR-18-383 · x_refsource_CONFIRM, x_transferred
- fortiguard.com /advisory/FG-IR-20-230 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-13380
- NVD: CVE-2018-13380
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.