Details of VAR-201906-0202

ID

VAR-201906-0202

CVE

CVE-2019-5588

TITLE

Fortinet FortiOS Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-005163

DESCRIPTION

A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests. Fortinet FortiOS Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Fortinet FortiOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Fortinet FortiOS 6.0.0 through 6.0.4 are vulnerable

Trust: 1.98

sources: NVD: CVE-2019-5588 // JVNDB: JVNDB-2019-005163 // BID: 108618 // VULHUB: VHN-157023

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortios	scope:	gte	version:	6.0.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lte	version:	6.0.4	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0.0 to 6.0.4	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0.4	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0.3	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0.1	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	6.0	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	6.2	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	6.0.5	Trust: 0.3

sources: BID: 108618 // JVNDB: JVNDB-2019-005163 // NVD: CVE-2019-5588

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-5588
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-5588
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201905-1023
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-157023
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-5588
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-157023
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-5588
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-157023 // JVNDB: JVNDB-2019-005163 // CNNVD: CNNVD-201905-1023 // NVD: CVE-2019-5588

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-157023 // JVNDB: JVNDB-2019-005163 // NVD: CVE-2019-5588

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-1023

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201905-1023

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-005163

PATCH

title:	FG-IR-19-034	url:	https://fortiguard.com/advisory/FG-IR-19-034	Trust: 0.8
title:	Fortinet FortiOS Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92975	Trust: 0.6

sources: JVNDB: JVNDB-2019-005163 // CNNVD: CNNVD-201905-1023

EXTERNAL IDS

db:	NVD	id:	CVE-2019-5588	Trust: 2.8
db:	BID	id:	108618	Trust: 2.0
db:	JVNDB	id:	JVNDB-2019-005163	Trust: 0.8
db:	CNNVD	id:	CNNVD-201905-1023	Trust: 0.6
db:	VULHUB	id:	VHN-157023	Trust: 0.1

sources: VULHUB: VHN-157023 // BID: 108618 // JVNDB: JVNDB-2019-005163 // CNNVD: CNNVD-201905-1023 // NVD: CVE-2019-5588

REFERENCES

url:	http://www.securityfocus.com/bid/108618	Trust: 2.3
url:	https://fortiguard.com/advisory/fg-ir-19-034	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-5588	Trust: 1.4
url:	https://www.fortinet.com/products/fortigate/fortios.html	Trust: 0.9
url:	https://fortiguard.com/psirt/fg-ir-19-034	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-5588	Trust: 0.8
url:	https://vigilance.fr/vulnerability/fortios-cross-site-scripting-via-the-vpn-portal-29412	Trust: 0.6

sources: VULHUB: VHN-157023 // BID: 108618 // JVNDB: JVNDB-2019-005163 // CNNVD: CNNVD-201905-1023 // NVD: CVE-2019-5588

CREDITS

Nathan Hardy from Sogeti Luxembourg.

Trust: 0.9

sources: BID: 108618 // CNNVD: CNNVD-201905-1023

SOURCES

db:	VULHUB	id:	VHN-157023
db:	BID	id:	108618
db:	JVNDB	id:	JVNDB-2019-005163
db:	CNNVD	id:	CNNVD-201905-1023
db:	NVD	id:	CVE-2019-5588

LAST UPDATE DATE

2024-08-14T15:02:16.928000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-157023	date:	2019-06-06T00:00:00
db:	BID	id:	108618	date:	2019-05-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-005163	date:	2019-06-17T00:00:00
db:	CNNVD	id:	CNNVD-201905-1023	date:	2019-06-10T00:00:00
db:	NVD	id:	CVE-2019-5588	date:	2019-06-06T08:29:01.163

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-157023	date:	2019-06-04T00:00:00
db:	BID	id:	108618	date:	2019-05-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-005163	date:	2019-06-17T00:00:00
db:	CNNVD	id:	CNNVD-201905-1023	date:	2019-05-27T00:00:00
db:	NVD	id:	CVE-2019-5588	date:	2019-06-04T22:29:00.423