CVE-2019-16151

published 2025-03-21

CVE-2019-16151: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote…

Priority P4 28 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context.
This happens when the FortiGate has web filtering and category override enabled/configured.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortigate	—	—
fortinet	fortios	—	—
fortinet	fortios	>= 6.2.0 < 6.2.10	6.2.10
fortinet	fortios	6.2.0 – 6.2.9	—
fortinet	fortios	>= 6.4.0 < 6.4.2	6.4.2
fortinet	fortios	6.4.0 – 6.4.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79