CVE-2019-5588 - A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests

Back Back to CVE browser

MEDIUM

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests

Published Jun 4, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 0.83%

Description

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.

Affected products

Vendor Fortinet Product Fortinet FortiOS Default
n/a
- Version
  FortiOS 6.0.0 to 6.0.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

Fortinet FortiOS

n/a

Version	Status	Constraints
FortiOS 6.0.0 to 6.0.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

http://www.securityfocus.com/bid/108618
vdb-entryx_refsource_BID
https://fortiguard.com/advisory/FG-IR-19-034
x_refsource_CONFIRMMitigationVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/108618		vdb-entryx_refsource_BID
https://fortiguard.com/advisory/FG-IR-19-034		x_refsource_CONFIRMMitigationVendor Advisory