CVE-2017-14190

Published: Jan 29, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests.

Affected (3)

Products: Fortinet: Fortios

Fortinet

1 product

Fortios

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	Up to 5.2.0
Fortinet Fortios	From 5.4.0 to 5.4.7
Fortinet Fortios	From 5.6.0 to 5.6.2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

http://www.securityfocus.com/bid/102779

Source: psirt@fortinet.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040284

Source: psirt@fortinet.com

Third Party AdvisoryVDB Entry

https://fortiguard.com/advisory/FG-IR-17-262

Source: psirt@fortinet.com

MitigationVendor Advisory

http://www.securityfocus.com/bid/102779

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040284

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://fortiguard.com/advisory/FG-IR-17-262

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.