Details of VAR-201904-0616

ID

VAR-201904-0616

CVE

CVE-2018-1356

TITLE

Fortinet FortiSandbox Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-003298

DESCRIPTION

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component. Fortinet FortiSandbox Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. FortinetFortiSandbox is an APT (Advanced Persistent Threat) protection device from Fortinet. The device provides dual sandbox technology, dynamic threat intelligence, real-time control panels and reporting. The vulnerability stems from the lack of proper validation of client data for web applications. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions such as reading, modifying, or deleting content on behalf of the victim on the SharePoint site

Trust: 2.52

sources: NVD: CVE-2018-1356 // JVNDB: JVNDB-2019-003298 // CNVD: CNVD-2019-13555 // BID: 107838 // VULHUB: VHN-123631

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-13555

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortisandbox	scope:	lt	version:	3.0	Trust: 1.4
vendor:	fortinet	model:	fortisandbox	scope:	lt	version:	3.0.0	Trust: 1.0
vendor:	fortinet	model:	fortisandbox	scope:	eq	version:	2.5.2	Trust: 0.3
vendor:	fortinet	model:	fortisandbox	scope:	eq	version:	2.5.1	Trust: 0.3
vendor:	fortinet	model:	fortisandbox	scope:	eq	version:	2.5	Trust: 0.3
vendor:	fortinet	model:	fortisandbox	scope:	eq	version:	2.4.1	Trust: 0.3
vendor:	fortinet	model:	fortisandbox	scope:	eq	version:	2.4	Trust: 0.3
vendor:	fortinet	model:	fortisandbox	scope:	ne	version:	3.0	Trust: 0.3

sources: CNVD: CNVD-2019-13555 // BID: 107838 // JVNDB: JVNDB-2019-003298 // NVD: CVE-2018-1356

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-1356
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-1356
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2019-13555
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201904-199
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-123631
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-1356
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-13555
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-123631
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-1356
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2019-13555 // VULHUB: VHN-123631 // JVNDB: JVNDB-2019-003298 // CNNVD: CNNVD-201904-199 // NVD: CVE-2018-1356

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-123631 // JVNDB: JVNDB-2019-003298 // NVD: CVE-2018-1356

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-199

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201904-199

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-003298

PATCH

title:	FG-IR-18-024	url:	https://fortiguard.com/advisory/FG-IR-18-024	Trust: 0.8
title:	Patch for FortinetFortiSandbox Cross-Site Scripting Vulnerability (CNVD-2019-13555)	url:	https://www.cnvd.org.cn/patchInfo/show/160657	Trust: 0.6
title:	Fortinet FortiSandbox Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=91087	Trust: 0.6

sources: CNVD: CNVD-2019-13555 // JVNDB: JVNDB-2019-003298 // CNNVD: CNNVD-201904-199

EXTERNAL IDS

db:	NVD	id:	CVE-2018-1356	Trust: 3.4
db:	BID	id:	107838	Trust: 2.6
db:	JVNDB	id:	JVNDB-2019-003298	Trust: 0.8
db:	CNNVD	id:	CNNVD-201904-199	Trust: 0.7
db:	CNVD	id:	CNVD-2019-13555	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.1145	Trust: 0.6
db:	VULHUB	id:	VHN-123631	Trust: 0.1

sources: CNVD: CNVD-2019-13555 // VULHUB: VHN-123631 // BID: 107838 // JVNDB: JVNDB-2019-003298 // CNNVD: CNNVD-201904-199 // NVD: CVE-2018-1356

REFERENCES

url:	http://www.securityfocus.com/bid/107838	Trust: 2.3
url:	https://fortiguard.com/advisory/fg-ir-18-024	Trust: 1.7
url:	https://fortiguard.com/psirt/fg-ir-18-024	Trust: 1.5
url:	https://nvd.nist.gov/vuln/detail/cve-2018-1356	Trust: 1.4
url:	http://www.fortinet.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1356	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/78446	Trust: 0.6

sources: CNVD: CNVD-2019-13555 // VULHUB: VHN-123631 // BID: 107838 // JVNDB: JVNDB-2019-003298 // CNNVD: CNNVD-201904-199 // NVD: CVE-2018-1356

CREDITS

Hizmetleri Ltd.ti.,Yasar Calay, Beyaz Bilgisayar Danmanlk

Trust: 0.6

sources: CNNVD: CNNVD-201904-199

SOURCES

db:	CNVD	id:	CNVD-2019-13555
db:	VULHUB	id:	VHN-123631
db:	BID	id:	107838
db:	JVNDB	id:	JVNDB-2019-003298
db:	CNNVD	id:	CNNVD-201904-199
db:	NVD	id:	CVE-2018-1356

LAST UPDATE DATE

2024-11-23T23:08:25.524000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-13555	date:	2019-05-10T00:00:00
db:	VULHUB	id:	VHN-123631	date:	2019-05-02T00:00:00
db:	BID	id:	107838	date:	2019-04-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-003298	date:	2019-05-14T00:00:00
db:	CNNVD	id:	CNNVD-201904-199	date:	2019-04-19T00:00:00
db:	NVD	id:	CVE-2018-1356	date:	2024-11-21T03:59:41.217

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-13555	date:	2019-05-10T00:00:00
db:	VULHUB	id:	VHN-123631	date:	2019-04-09T00:00:00
db:	BID	id:	107838	date:	2019-04-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-003298	date:	2019-05-14T00:00:00
db:	CNNVD	id:	CNNVD-201904-199	date:	2019-04-04T00:00:00
db:	NVD	id:	CVE-2018-1356	date:	2019-04-09T21:29:00.223