| Severity | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE ID | CVE-2019-5590 |
| CVSSv3 |
6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C] |
| CWE ID |
CWE-79 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Fortinet FortiWeb |
| Vulnerable software versions |
Fortinet FortiWeb 6.0.2 Fortinet FortiWeb 6.0.1 Fortinet FortiWeb 6.0.0 |
| Vendor URL | Fortinet, Inc |
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when displaying attack report elements. A remote attacker can send specially crafted payload that will be executed in victim's browser once the victim views the attack report in HTML format.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
RemediationInstall updates from vendor's website.
External links