Details of VAR-201404-0476

ID

VAR-201404-0476

CVE

CVE-2014-0331

TITLE

Fortinet FortiADC D-series contains a cross-site scripting vulnerability

Trust: 0.8

sources: CERT/CC: VU#667340

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/. (CWE-79). Fortinet Provided by FortiADC Contains a cross-site scripting vulnerability. Fortinet Provided by FortiADC Is /FortiADC/gui_partA/?locale=en of locale There is a problem with parameter processing and cross-site scripting (CWE-79) Vulnerabilities exist. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. FortiADC versions 3.2.0 and prior are vulnerable. FortiADC is an application delivery controller from Fortinet, which optimizes network availability, user experience, mobile performance and cloud-based enterprise application control, and enhances server efficiency and reduces data center network complexity. and cost. The vulnerability is due to the fact that the gui_partA/ URI does not adequately filter the 'locale' parameter

Trust: 2.7

sources: NVD: CVE-2014-0331 // CERT/CC: VU#667340 // JVNDB: JVNDB-2014-001960 // BID: 66642 // VULHUB: VHN-67824

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortiadc	scope:	lte	version:	3.2.0	Trust: 1.0
vendor:	fortinet	model:	fortiadc-400e	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-2000d	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-4000d	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-300e	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-1000e	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-600e	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-200d	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	fortiadc-1500d	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	fortinet	model:	fortiadc	scope:	lte	version:	3.2	Trust: 0.8
vendor:	fortinet	model:	fortiadc	scope:	eq	version:	3.2.0	Trust: 0.6

sources: CERT/CC: VU#667340 // JVNDB: JVNDB-2014-001960 // CNNVD: CNNVD-201404-119 // NVD: CVE-2014-0331

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-0331
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-0331
value:	MEDIUM
Trust: 0.8
IPA:	JVNDB-2014-001960
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201404-119
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-67824
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-0331
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	CVE-2014-0331
severity:	MEDIUM
baseScore:	4.3
vectorString:	NONE
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
IPA:	JVNDB-2014-001960
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-67824
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#667340 // VULHUB: VHN-67824 // JVNDB: JVNDB-2014-001960 // CNNVD: CNNVD-201404-119 // NVD: CVE-2014-0331

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 2.7

sources: CERT/CC: VU#667340 // VULHUB: VHN-67824 // JVNDB: JVNDB-2014-001960 // NVD: CVE-2014-0331

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-119

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201404-119

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-001960

EXPLOIT AVAILABILITY

sources: CERT/CC: VU#667340

PATCH

title:	Application Delivery Controller (ADC) - Load Balancer	url:	http://www.fortinet.com/products/fortiadc/index.html	Trust: 0.8
title:	FortiADC Cross-Site Scripting Vulnerability	url:	http://www.fortiguard.com/advisory/FG-IR-14-004/	Trust: 0.8

sources: JVNDB: JVNDB-2014-001960

EXTERNAL IDS

db:	NVD	id:	CVE-2014-0331	Trust: 2.8
db:	CERT/CC	id:	VU#667340	Trust: 2.7
db:	BID	id:	66642	Trust: 1.4
db:	SECTRACK	id:	1030018	Trust: 1.1
db:	JVN	id:	JVNVU98858887	Trust: 0.8
db:	JVNDB	id:	JVNDB-2014-001960	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-119	Trust: 0.7
db:	FULLDISC	id:	20140403 XSS REFLECTED VULNERABILITIES IN OS OF FORTIADC V3.2 (CVE-2014-0331)	Trust: 0.6
db:	VULHUB	id:	VHN-67824	Trust: 0.1

sources: CERT/CC: VU#667340 // VULHUB: VHN-67824 // BID: 66642 // JVNDB: JVNDB-2014-001960 // CNNVD: CNNVD-201404-119 // NVD: CVE-2014-0331

REFERENCES

url:	http://seclists.org/fulldisclosure/2014/apr/53	Trust: 3.3
url:	http://www.kb.cert.org/vuls/id/667340	Trust: 1.9
url:	http://www.fortiguard.com/advisory/fg-ir-14-004	Trust: 1.7
url:	http://www.securityfocus.com/bid/66642	Trust: 1.1
url:	http://www.securitytracker.com/id/1030018	Trust: 1.1
url:	http://www.fortiguard.com/advisory/fg-ir-14-004/	Trust: 0.8
url:	http://cwe.mitre.org/data/definitions/79.html	Trust: 0.8
url:	http://www.fortinet.com/products/fortiadc/index.html	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0331	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu98858887/index.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0331	Trust: 0.8

sources: CERT/CC: VU#667340 // VULHUB: VHN-67824 // JVNDB: JVNDB-2014-001960 // CNNVD: CNNVD-201404-119 // NVD: CVE-2014-0331

CREDITS

William Costa

Trust: 0.3

sources: BID: 66642

SOURCES

db:	CERT/CC	id:	VU#667340
db:	VULHUB	id:	VHN-67824
db:	BID	id:	66642
db:	JVNDB	id:	JVNDB-2014-001960
db:	CNNVD	id:	CNNVD-201404-119
db:	NVD	id:	CVE-2014-0331

LAST UPDATE DATE

2024-09-09T23:09:50.940000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#667340	date:	2014-04-15T00:00:00
db:	VULHUB	id:	VHN-67824	date:	2017-12-16T00:00:00
db:	BID	id:	66642	date:	2014-04-17T03:59:00
db:	JVNDB	id:	JVNDB-2014-001960	date:	2014-04-14T00:00:00
db:	CNNVD	id:	CNNVD-201404-119	date:	2014-04-14T00:00:00
db:	NVD	id:	CVE-2014-0331	date:	2017-12-16T02:29:03.793

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#667340	date:	2014-04-11T00:00:00
db:	VULHUB	id:	VHN-67824	date:	2014-04-10T00:00:00
db:	BID	id:	66642	date:	2014-04-03T00:00:00
db:	JVNDB	id:	JVNDB-2014-001960	date:	2014-04-14T00:00:00
db:	CNNVD	id:	CNNVD-201404-119	date:	2014-04-14T00:00:00
db:	NVD	id:	CVE-2014-0331	date:	2014-04-10T20:29:20.440