Unscored severity · published May 12, 2015
CVE-2015-3620
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fortianalyzer Firmware · Fortinet
5.0.0; 5.0.1; 5.0.10; 5.2.0; 5.2.1 · source: NVD
FF
Fortimanager Firmware · Fortinet
5.0.3; 5.0.4; 5.0.5; 5.0.6; 5.0.7; 5.0.8; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3620
Exploit
http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2015/May/13
Vendor Advisory
http://www.fortiguard.com/advisory/FG-IR-15-005/
www.securityfocus.com
http://www.securityfocus.com/archive/1/535452/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/74646
Third Party Advisory
http://www.securitytracker.com/id/1032262
More from Fortianalyzer Firmware
6.1
CVE-2017-17541
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code…
6.1
CVE-2017-3126
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the…
6.1
CVE-2016-3195
Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6…
6.1
CVE-2016-3194
Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x…
5.4
CVE-2015-7363
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and…