CVE-2019-16154 — Cross-site Scripting in Fortinet Fortiauthenticator WEB UI

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 32.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet Fortiauthenticator WEB UIFortinet Fortiauthenticator
Timeline
PublishedJan 7
Latest updateMay 24

Description

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-3g24-4p5j-c5q8: An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6↗2022-05-24
▶
CVEList
CVE-2019-16154: An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6↗2020-01-07
▶

📋Vendor Advisories

1
Fortinet
An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthent...↗2020-01-07
▶
CVE-2019-16154 — Cross-site Scripting in Fortinet | cvebase