Medium severity · published Aug 5, 2016
CVE-2016-3196
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote…
5.4
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fortianalyzer Firmware · Fortinet
5.0.0; 5.0.1; 5.0.4; 5.0.5; 5.0.10; 5.2.0; +5 more · source: NVD
FF
Fortimanager Firmware · Fortinet
5.0.3; 5.0.4; 5.0.5; 5.0.6; 5.0.7; 5.0.8; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3196
Vendor Advisory
http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability
Third Party Advisory
http://seclists.org/fulldisclosure/2016/Aug/4
www.securityfocus.com
http://www.securityfocus.com/archive/1/539069/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/92203
www.securitytracker.com
http://www.securitytracker.com/id/1036550
Third Party Advisory
http://www.securitytracker.com/id/1036551
More from Fortianalyzer Firmware
6.1
CVE-2017-17541
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code…
6.1
CVE-2017-3126
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the…
6.1
CVE-2016-3195
Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6…
6.1
CVE-2016-3194
Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x…
5.4
CVE-2015-7363
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and…