ID
VAR-202009-0093
CVE
CVE-2020-12811
TITLE
FortiManager and FortiAnalyzer Cross-site scripting vulnerability
Trust: 0.6
DESCRIPTION
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field. Both Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains (ADOMs) to further simplify multi-device security deployment and management. Fortinet FortiAnalyzer is a centralized network security reporting solution. This product is mainly used to collect network log data, and analyze, report, and archive the security events, network traffic, and Web content in the logs through the report suite. FortiManager and FortiAnalyzer have a cross-site scripting vulnerability, which stems from the lack of proper validation of client-side data in WEB applications. An attacker could exploit this vulnerability to execute client code
Trust: 0.99
AFFECTED PRODUCTS
| vendor: | fortinet | model: | fortianalyzer | scope: | lte | version: | 6.2.6 | Trust: 1.0 |
| vendor: | fortinet | model: | fortianalyzer | scope: | gte | version: | 6.2.0 | Trust: 1.0 |
| vendor: | fortinet | model: | fortimanager | scope: | lte | version: | 6.2.6 | Trust: 1.0 |
| vendor: | fortinet | model: | fortimanager | scope: | gte | version: | 6.2.0 | Trust: 1.0 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-79 | Trust: 1.1 |
THREAT TYPE
remote
Trust: 0.6
TYPE
XSS
Trust: 0.6
PATCH
| title: | FortiManager and FortiAnalyzer Fixes for cross-site scripting vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=129276 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-12811 | Trust: 1.7 |
| db: | CNNVD | id: | CNNVD-202009-1256 | Trust: 0.7 |
| db: | AUSCERT | id: | ESB-2020.3210 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-165527 | Trust: 0.1 |
REFERENCES
| url: | https://fortiguard.com/advisory/fg-ir-20-005 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-12811 | Trust: 0.6 |
| url: | https://vigilance.fr/vulnerability/fortimanager-fortianalyzer-cross-site-scripting-via-identify-provider-name-33367 | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2020.3210/ | Trust: 0.6 |
SOURCES
| db: | VULHUB | id: | VHN-165527 |
| db: | CNNVD | id: | CNNVD-202009-1256 |
| db: | NVD | id: | CVE-2020-12811 |
LAST UPDATE DATE
2024-08-14T14:03:35.516000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-165527 | date: | 2020-09-30T00:00:00 |
| db: | CNNVD | id: | CNNVD-202009-1256 | date: | 2020-10-09T00:00:00 |
| db: | NVD | id: | CVE-2020-12811 | date: | 2020-09-30T19:18:09.800 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-165527 | date: | 2020-09-24T00:00:00 |
| db: | CNNVD | id: | CNNVD-202009-1256 | date: | 2020-09-18T00:00:00 |
| db: | NVD | id: | CVE-2020-12811 | date: | 2020-09-24T18:15:16.887 |