Stored XSS in FortiWeb reports

Published: 2019-06-13 09:36:10 | Updated: 2019-06-13
Severity Medium
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2019-5590
CVSSv3 6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CWE ID CWE-79
Exploitation vector Network
Public exploit N/A
Vulnerable software Fortinet FortiWeb
Vulnerable software versions Fortinet FortiWeb 6.0.2
Fortinet FortiWeb 6.0.1
Fortinet FortiWeb 6.0.0
Vendor URL Fortinet, Inc

Security Advisory

1) Stored cross-site scripting

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when displaying attack report elements. A remote attacker can send specially crafted payload that will be executed in victim's browser once the victim views the attack report in HTML format.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install updates from vendor's website.

External links

https://fortiguard.com/psirt/FG-IR-19-070

Back to List