CVE-2017-3129 — Cross-site Scripting in Fortinet Fortiweb

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 50.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiwebFortinet INC Fortinet Fortiweb
Timeline
PublishedMay 27
Latest updateMay 17

Description

A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5fortinet_inc/fortinet_fortiwebFortiWeb versions 5.7.1 and below

🔴Vulnerability Details

2
GHSA
GHSA-hmx8-w4r7-p975: A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5↗2022-05-17
▶
CVEList
CVE-2017-3129: A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5↗2017-05-26
▶

📋Vendor Advisories

1
Fortinet
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthoriz...↗2017-05-27
▶
CVE-2017-3129 — Cross-site Scripting in Fortinet | cvebase