CVE-2017-3128 — Cross-site Scripting in Fortinet Fortios

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
EPSS
0.3%
top 46.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiosFortinet Fortios
Timeline
PublishedMay 23
Latest updateMay 17

Description

A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDfortinet/fortios26 versions+25
▶CVEListV5fortinet/fortinet_fortios5.0.0-5.0.14, 5.2.0-5.2.10

🔴Vulnerability Details

2
GHSA
GHSA-24wc-f6vq-w8mh: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-↗2022-05-17
▶
CVEList
CVE-2017-3128: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-↗2017-05-23
▶

📋Vendor Advisories

1
Fortinet
A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or c...↗2017-05-23
▶
CVE-2017-3128 — Cross-site Scripting in Fortinet | cvebase