CVE-2017-14186

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote…

published November 29, 2017

CVSS
—
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03718 · 89.7th percentile
Published
2017-11-29T19:00Z
EPSS history
Timeline
  • 29 NOV 19:00Z
    A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote…
    cvelistv5