Details of VAR-201404-0182

ID

VAR-201404-0182

CVE

CVE-2014-1955

TITLE

FortiGuard FortiWeb Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2014-002342

DESCRIPTION

Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Fortinet Fortiweb is prone to multiple security vulnerabilities, including; 1. A cross-site scripting vulnerability 2. A security-bypass vulnerability 3. An HTTP Header Injection Vulnerability An attacker can exploit these issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, bypass security restrictions to obtain sensitive information, or insert arbitrary headers into an HTTP response, which may help them launch other attacks. Fortinet Fortiweb 5.0.2 and prior are vulnerable. Fortinet FortiGuard FortiWeb is a web application layer firewall developed by Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, etc. Sensitive database content

Trust: 1.98

sources: NVD: CVE-2014-1955 // JVNDB: JVNDB-2014-002342 // BID: 65660 // VULHUB: VHN-69894

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortiweb	scope:	lte	version:	5.0.2	Trust: 1.0
vendor:	fortinet	model:	fortiweb	scope:	eq	version:	5.0.2	Trust: 0.9
vendor:	fortinet	model:	fortiweb	scope:	lt	version:	5.0.3	Trust: 0.8
vendor:	fortinet	model:	fortiweb	scope:	eq	version:	4.4.7	Trust: 0.3
vendor:	fortinet	model:	fortiweb	scope:	ne	version:	5.0.3	Trust: 0.3

sources: BID: 65660 // JVNDB: JVNDB-2014-002342 // CNNVD: CNNVD-201404-603 // NVD: CVE-2014-1955

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-1955
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-1955
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201404-603
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-69894
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-1955
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-69894
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-69894 // JVNDB: JVNDB-2014-002342 // CNNVD: CNNVD-201404-603 // NVD: CVE-2014-1955

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-69894 // JVNDB: JVNDB-2014-002342 // NVD: CVE-2014-1955

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-603

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201404-603

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-002342

PATCH

title:

FortiWeb Multiple Vulnerabilities

url:

http://www.fortiguard.com/advisory/FG-IR-13-009/

Trust: 0.8

sources: JVNDB: JVNDB-2014-002342

EXTERNAL IDS

db:	NVD	id:	CVE-2014-1955	Trust: 2.8
db:	JVNDB	id:	JVNDB-2014-002342	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-603	Trust: 0.7
db:	SECUNIA	id:	56981	Trust: 0.6
db:	BID	id:	65660	Trust: 0.3
db:	VULHUB	id:	VHN-69894	Trust: 0.1

sources: VULHUB: VHN-69894 // BID: 65660 // JVNDB: JVNDB-2014-002342 // CNNVD: CNNVD-201404-603 // NVD: CVE-2014-1955

REFERENCES

url:	http://www.fortiguard.com/advisory/fg-ir-13-009/	Trust: 2.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1955	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1955	Trust: 0.8
url:	http://secunia.com/advisories/56981	Trust: 0.6
url:	http://www.fortinet.com/	Trust: 0.3

sources: VULHUB: VHN-69894 // BID: 65660 // JVNDB: JVNDB-2014-002342 // CNNVD: CNNVD-201404-603 // NVD: CVE-2014-1955

CREDITS

Robert van Hamburg of Intermax Security

Trust: 0.3

sources: BID: 65660

SOURCES

db:	VULHUB	id:	VHN-69894
db:	BID	id:	65660
db:	JVNDB	id:	JVNDB-2014-002342
db:	CNNVD	id:	CNNVD-201404-603
db:	NVD	id:	CVE-2014-1955

LAST UPDATE DATE

2024-08-14T14:21:08.786000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-69894	date:	2014-07-18T00:00:00
db:	BID	id:	65660	date:	2014-02-13T00:00:00
db:	JVNDB	id:	JVNDB-2014-002342	date:	2014-05-02T00:00:00
db:	CNNVD	id:	CNNVD-201404-603	date:	2014-05-06T00:00:00
db:	NVD	id:	CVE-2014-1955	date:	2014-07-18T18:38:52.357

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-69894	date:	2014-04-30T00:00:00
db:	BID	id:	65660	date:	2014-02-13T00:00:00
db:	JVNDB	id:	JVNDB-2014-002342	date:	2014-05-02T00:00:00
db:	CNNVD	id:	CNNVD-201404-603	date:	2014-04-30T00:00:00
db:	NVD	id:	CVE-2014-1955	date:	2014-04-30T14:22:06.173