CVE-2019-16151 — An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context

Back Back to CVE browser

MEDIUM

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context

Published Mar 21, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.37%

Description

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured.

Affected products

Vendor Fortinet Product FortiOS Default
unaffected
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.9
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.1