medium5.4
CVE-2016-3196
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before…
Impact
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortimanager Firmware | Versions 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8 |
| Fortinet | Fortianalyzer Firmware | Versions 5.0.0, 5.0.1, 5.0.4, 5.0.5, 5.0.10, 5.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability
- http://seclists.org/fulldisclosure/2016/Aug/4
- http://www.securityfocus.com/archive/1/539069/100/0/threaded
- http://www.securityfocus.com/bid/92203
- http://www.securitytracker.com/id/1036550
- http://www.securitytracker.com/id/1036551
- http://www.vulnerability-lab.com/get_content.php?id=1687
- http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability
- http://seclists.org/fulldisclosure/2016/Aug/4
- http://www.securityfocus.com/archive/1/539069/100/0/threaded
- http://www.securityfocus.com/bid/92203
- http://www.securitytracker.com/id/1036550
- http://www.securitytracker.com/id/1036551
- http://www.vulnerability-lab.com/get_content.php?id=1687