Medium severity · published Apr 8, 2016
CVE-2016-3978
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and…
6.1
CVSS
5.9%
EPSS
No
On KEV
Description
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiOS · Fortinet
5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3978
seclists.org
http://seclists.org/fulldisclosure/2016/Mar/68
Vendor Advisory
http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability
www.securitytracker.com
http://www.securitytracker.com/id/1035332
More from FortiOS
9.8
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.8
CVE-2025-25249
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
9.8
CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
9.8
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
9.8
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability