Details of VAR-201410-0764

ID

VAR-201410-0764

CVE

CVE-2014-2336

TITLE

Fortinet FortiManager and FortiAnalyzer of Web User Interface cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-005170

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335. FortiManager and FortiAnalyzer are prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to FortiManager and FortiAnalyzer 5.0.7 are vulnerable. Both Fortinet FortiManager and FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management solution. FortiAnalyzer is a centralized network security reporting solution

Trust: 1.98

sources: NVD: CVE-2014-2336 // JVNDB: JVNDB-2014-005170 // BID: 70889 // VULHUB: VHN-70275

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortimanager	scope:	lte	version:	5.0.6	Trust: 1.0
vendor:	fortinet	model:	fortianalyzer	scope:	lte	version:	5.0.6	Trust: 1.0
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.6	Trust: 0.9
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.6	Trust: 0.9
vendor:	fortinet	model:	fortianalyzer	scope:	lt	version:	5.0.7	Trust: 0.8
vendor:	fortinet	model:	fortimanager	scope:	lt	version:	5.0.7	Trust: 0.8
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	4.3	Trust: 0.3
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	3.0	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.5	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.4	Trust: 0.3
vendor:	fortinet	model:	fortimanager	scope:	ne	version:	5.0.7	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	ne	version:	5.0.7	Trust: 0.3

sources: BID: 70889 // JVNDB: JVNDB-2014-005170 // CNNVD: CNNVD-201410-1440 // NVD: CVE-2014-2336

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-2336
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-2336
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201410-1440
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-70275
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-2336
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-70275
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-70275 // JVNDB: JVNDB-2014-005170 // CNNVD: CNNVD-201410-1440 // NVD: CVE-2014-2336

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-70275 // JVNDB: JVNDB-2014-005170 // NVD: CVE-2014-2336

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-1440

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201410-1440

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-005170

PATCH

title:

Multiple XSS vulnerabilities in FortiManager and FortiAnalyzer Web UI

url:

http://www.fortiguard.com/advisory/FG-IR-14-033/

Trust: 0.8

sources: JVNDB: JVNDB-2014-005170

EXTERNAL IDS

db:	NVD	id:	CVE-2014-2336	Trust: 2.8
db:	BID	id:	70889	Trust: 1.4
db:	SECUNIA	id:	61309	Trust: 1.1
db:	JVNDB	id:	JVNDB-2014-005170	Trust: 0.8
db:	CNNVD	id:	CNNVD-201410-1440	Trust: 0.7
db:	VULHUB	id:	VHN-70275	Trust: 0.1

sources: VULHUB: VHN-70275 // BID: 70889 // JVNDB: JVNDB-2014-005170 // CNNVD: CNNVD-201410-1440 // NVD: CVE-2014-2336

REFERENCES

url:	http://www.fortiguard.com/advisory/fg-ir-14-033/	Trust: 2.0
url:	http://www.securityfocus.com/bid/70889	Trust: 1.1
url:	http://secunia.com/advisories/61309	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/98479	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2336	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2336	Trust: 0.8
url:	http://www.fortinet.com/products/fortianalyzer/	Trust: 0.3
url:	http://www.fortinet.com/products/fortimanager/	Trust: 0.3

sources: VULHUB: VHN-70275 // BID: 70889 // JVNDB: JVNDB-2014-005170 // CNNVD: CNNVD-201410-1440 // NVD: CVE-2014-2336

CREDITS

Oded Vanunu & Adi Volkovitz, Check Point Security Research Team.

Trust: 0.3

sources: BID: 70889

SOURCES

db:	VULHUB	id:	VHN-70275
db:	BID	id:	70889
db:	JVNDB	id:	JVNDB-2014-005170
db:	CNNVD	id:	CNNVD-201410-1440
db:	NVD	id:	CVE-2014-2336

LAST UPDATE DATE

2024-08-14T14:46:40.887000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-70275	date:	2017-08-29T00:00:00
db:	BID	id:	70889	date:	2014-11-03T00:00:00
db:	JVNDB	id:	JVNDB-2014-005170	date:	2014-11-04T00:00:00
db:	CNNVD	id:	CNNVD-201410-1440	date:	2014-11-02T00:00:00
db:	NVD	id:	CVE-2014-2336	date:	2017-08-29T01:34:30.890

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-70275	date:	2014-10-31T00:00:00
db:	BID	id:	70889	date:	2014-11-03T00:00:00
db:	JVNDB	id:	JVNDB-2014-005170	date:	2014-11-04T00:00:00
db:	CNNVD	id:	CNNVD-201410-1440	date:	2014-10-31T00:00:00
db:	NVD	id:	CVE-2014-2336	date:	2014-10-31T14:55:02.907