Description
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 5.6.0 to 5.6.2, 5.4.0 to 5.4.6, 5.2.0 to 5.2.12, 5.0 and below | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting http/cves/2017/CVE-2017-14186.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- 1039891 vdb-entry
- 101955 vdb-entry
- https://fortiguard.com/advisory/FG-IR-17-242