Details of VAR-201505-0377

ID

VAR-201505-0377

CVE

CVE-2015-3620

TITLE

Fortinet FortiAnalyzer and FortiManager Advanced Dataset Report Page Cross-Site Scripting Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-002670

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. FortiAnalyzer and FortiManager are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Both Fortinet FortiManager and FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management solution. FortiAnalyzer is a centralized network security reporting solution

Trust: 1.98

sources: NVD: CVE-2015-3620 // JVNDB: JVNDB-2015-002670 // BID: 74646 // VULHUB: VHN-81581

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.2.1	Trust: 1.9
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.8	Trust: 1.9
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.7	Trust: 1.9
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.6	Trust: 1.9
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.2.1	Trust: 1.9
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.10	Trust: 1.9
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.1	Trust: 1.6
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.2.0	Trust: 1.6
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.2.0	Trust: 1.6
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.0	Trust: 1.6
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.10	Trust: 1.3
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.9	Trust: 1.3
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.5	Trust: 1.3
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.4	Trust: 1.3
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.3	Trust: 1.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.0 to 5.0.10	Trust: 0.8
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.2.0 to 5.2.1	Trust: 0.8
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.0.3 to 5.0.10	Trust: 0.8
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.2.0 to 5.2.1	Trust: 0.8
vendor:	fortinet	model:	fortimanager	scope:	eq	version:	5.2	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.2	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.7	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.5	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0.4	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	eq	version:	5.0	Trust: 0.3
vendor:	fortinet	model:	fortimanager	scope:	ne	version:	5.2.2	Trust: 0.3
vendor:	fortinet	model:	fortianalyzer	scope:	ne	version:	5.2.2	Trust: 0.3

sources: BID: 74646 // JVNDB: JVNDB-2015-002670 // CNNVD: CNNVD-201505-031 // NVD: CVE-2015-3620

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-3620
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-3620
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201505-031
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-81581
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-3620
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-81581
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-81581 // JVNDB: JVNDB-2015-002670 // CNNVD: CNNVD-201505-031 // NVD: CVE-2015-3620

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-81581 // JVNDB: JVNDB-2015-002670 // NVD: CVE-2015-3620

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-031

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201505-031

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-002670

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-81581

PATCH

title:

Multiple products cross-site scripting vulnerabilities

url:

http://www.fortiguard.com/advisory/FG-IR-15-005/

Trust: 0.8

sources: JVNDB: JVNDB-2015-002670

EXTERNAL IDS

db:	NVD	id:	CVE-2015-3620	Trust: 2.8
db:	PACKETSTORM	id:	131766	Trust: 1.7
db:	BID	id:	74646	Trust: 1.4
db:	SECTRACK	id:	1032262	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-002670	Trust: 0.8
db:	CNNVD	id:	CNNVD-201505-031	Trust: 0.7
db:	SECUNIA	id:	64308	Trust: 0.6
db:	VULHUB	id:	VHN-81581	Trust: 0.1

sources: VULHUB: VHN-81581 // BID: 74646 // JVNDB: JVNDB-2015-002670 // CNNVD: CNNVD-201505-031 // NVD: CVE-2015-3620

REFERENCES

url:	http://www.fortiguard.com/advisory/fg-ir-15-005/	Trust: 2.0
url:	http://packetstormsecurity.com/files/131766/fortinet-fortianalyzer-fortimanager-cross-site-scripting.html	Trust: 1.7
url:	http://www.securityfocus.com/bid/74646	Trust: 1.1
url:	http://www.securityfocus.com/archive/1/535452/100/0/threaded	Trust: 1.1
url:	http://seclists.org/fulldisclosure/2015/may/13	Trust: 1.1
url:	http://www.securitytracker.com/id/1032262	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3620	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3620	Trust: 0.8
url:	http://secunia.com/advisories/64308	Trust: 0.6
url:	http://www.fortinet.com/products/fortimail/	Trust: 0.3

sources: VULHUB: VHN-81581 // BID: 74646 // JVNDB: JVNDB-2015-002670 // CNNVD: CNNVD-201505-031 // NVD: CVE-2015-3620

CREDITS

Jared Haight, William Costa, and Benjamin Kunz Mejri (Vulnerability Laboratory, Evolution Security GmbH).

Trust: 0.3

sources: BID: 74646

SOURCES

db:	VULHUB	id:	VHN-81581
db:	BID	id:	74646
db:	JVNDB	id:	JVNDB-2015-002670
db:	CNNVD	id:	CNNVD-201505-031
db:	NVD	id:	CVE-2015-3620

LAST UPDATE DATE

2024-08-14T13:47:42.586000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-81581	date:	2018-10-09T00:00:00
db:	BID	id:	74646	date:	2015-02-25T00:00:00
db:	JVNDB	id:	JVNDB-2015-002670	date:	2015-05-18T00:00:00
db:	CNNVD	id:	CNNVD-201505-031	date:	2015-05-13T00:00:00
db:	NVD	id:	CVE-2015-3620	date:	2018-10-09T19:56:55.827

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-81581	date:	2015-05-12T00:00:00
db:	BID	id:	74646	date:	2015-02-25T00:00:00
db:	JVNDB	id:	JVNDB-2015-002670	date:	2015-05-18T00:00:00
db:	CNNVD	id:	CNNVD-201505-031	date:	2015-05-07T00:00:00
db:	NVD	id:	CVE-2015-3620	date:	2015-05-12T19:59:23.043