medium4.7
CVE-2019-16151
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenti…
Impact
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortios | from 6.2.0 before 6.2.10 from 6.4.0 before 6.4.2 |