Sign-up

ID

VAR-201807-0298


CVE

CVE-2017-17541


TITLE

Fortinet FortiManager and FortiAnalyzer Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2017-014053

DESCRIPTION

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature. Fortinet FortiManager and FortiAnalyzer Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Fortinet FortiManager and FortiAnalyzer are prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. The following products are affected: FortiManager 6.0.0, 5.6.4 and prior FortiAnalyzer 6.0.0, 5.6.4 and prior. Both Fortinet FortiManager and FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management solution. FortiAnalyzer is a centralized network security reporting solution. Cross-site scripting vulnerabilities exist in Fortinet FortiManager 6.0.0, 5.6.4 and earlier versions and FortiAnalyzer 6.0.0, 5.6.4 and earlier versions

Trust: 1.98

sources: NVD: CVE-2017-17541 // JVNDB: JVNDB-2017-014053 // BID: 105129 // VULHUB: VHN-108574

AFFECTED PRODUCTS

vendor:fortinetmodel:fortianalyzerscope:eqversion:6.0.0

Trust: 2.4

vendor:fortinetmodel:fortimanagerscope:eqversion:6.0.0

Trust: 2.4

vendor:fortinetmodel:fortianalyzerscope:lteversion:5.6.4

Trust: 1.8

vendor:fortinetmodel:fortimanagerscope:lteversion:5.6.4

Trust: 1.8

vendor:fortinetmodel:fortimanagerscope:eqversion:5.6.4

Trust: 0.9

vendor:fortinetmodel:fortianalyzerscope:eqversion:5.6.4

Trust: 0.9

vendor:fortinetmodel:fortimanagerscope:eqversion:6.0

Trust: 0.3

vendor:fortinetmodel:fortianalyzerscope:eqversion:6.0

Trust: 0.3

vendor:fortinetmodel:fortimanagerscope:neversion:6.0.1

Trust: 0.3

vendor:fortinetmodel:fortimanagerscope:neversion:5.6.5

Trust: 0.3

vendor:fortinetmodel:fortianalyzerscope:neversion:6.0.1

Trust: 0.3

vendor:fortinetmodel:fortianalyzerscope:neversion:5.6.5

Trust: 0.3

sources: BID: 105129 // JVNDB: JVNDB-2017-014053 // CNNVD: CNNVD-201712-458 // NVD: CVE-2017-17541

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-17541
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-17541
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201712-458
value: MEDIUM

Trust: 0.6

VULHUB: VHN-108574
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-17541
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-108574
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-17541
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-108574 // JVNDB: JVNDB-2017-014053 // CNNVD: CNNVD-201712-458 // NVD: CVE-2017-17541

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-108574 // JVNDB: JVNDB-2017-014053 // NVD: CVE-2017-17541

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-458

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201712-458

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014053

PATCH
title:FG-IR-17-305url:https://fortiguard.com/psirt/FG-IR-17-305
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-014053

EXTERNAL IDS
db:NVDid:CVE-2017-17541
Trust: 2.8
db:SECTRACKid:1041246
Trust: 1.1
db:SECTRACKid:1041247
Trust: 1.1
db:JVNDBid:JVNDB-2017-014053
Trust: 0.8
db:CNNVDid:CNNVD-201712-458
Trust: 0.7
db:BIDid:105129
Trust: 0.4
db:VULHUBid:VHN-108574
Trust: 0.1
sources:
            
            
            VULHUB: VHN-108574 // 
            
            
            
            BID: 105129 // 
            
            
            
            JVNDB: JVNDB-2017-014053 // 
            
            
            
            CNNVD: CNNVD-201712-458 // 
            
            
            
            NVD: CVE-2017-17541

REFERENCES
url:https://fortiguard.com/advisory/fg-ir-17-305
Trust: 1.7
url:http://www.securitytracker.com/id/1041246
Trust: 1.1
url:http://www.securitytracker.com/id/1041247
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17541
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-17541
Trust: 0.8
url:https://www.fortinet.com/
Trust: 0.3
url:https://fortiguard.com/psirt/fg-ir-17-305
Trust: 0.3
sources:
            
            
            VULHUB: VHN-108574 // 
            
            
            
            BID: 105129 // 
            
            
            
            JVNDB: JVNDB-2017-014053 // 
            
            
            
            CNNVD: CNNVD-201712-458 // 
            
            
            
            NVD: CVE-2017-17541

CREDITS
Hassan Kooshkaki and Farid Heydari.
Trust: 0.3
sources:
            
            
            BID: 105129

SOURCES
db:VULHUBid:VHN-108574
db:BIDid:105129
db:JVNDBid:JVNDB-2017-014053
db:CNNVDid:CNNVD-201712-458
db:NVDid:CVE-2017-17541

LAST UPDATE DATE
2024-08-14T14:57:15.761000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-108574date:2018-09-12T00:00:00
db:BIDid:105129date:2018-07-05T00:00:00
db:JVNDBid:JVNDB-2017-014053date:2018-10-09T00:00:00
db:CNNVDid:CNNVD-201712-458date:2018-07-17T00:00:00
db:NVDid:CVE-2017-17541date:2018-09-12T19:22:27.007

SOURCES RELEASE DATE
db:VULHUBid:VHN-108574date:2018-07-16T00:00:00
db:BIDid:105129date:2018-07-05T00:00:00
db:JVNDBid:JVNDB-2017-014053date:2018-10-09T00:00:00
db:CNNVDid:CNNVD-201712-458date:2017-12-12T00:00:00
db:NVDid:CVE-2017-17541date:2018-07-16T20:29:00.270