CVE-2019-5590 — Cross-site Scripting in Fortinet Fortiweb

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 53.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedAug 28
Latest updateMay 24

Description

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5fortinet/fortiweb6.0.2 and below

🔴Vulnerability Details

2
GHSA
GHSA-xmwv-j3qp-w2f2: The URL part of the report message is not encoded in Fortinet FortiWeb 6↗2022-05-24
▶
CVEList
CVE-2019-5590: The URL part of the report message is not encoded in Fortinet FortiWeb 6↗2019-08-28
▶

📋Vendor Advisories

1
Fortinet
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to ex...↗2019-08-28
▶
CVE-2019-5590 — Cross-site Scripting in Fortinet | cvebase