Cross-Site Scripting Vulnerability in FortiAuthenticator Web UI by Fortinet
CVE-2019-16154

6.1MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortiauthenticator Web Ui
Vendor
CVE Published:
7 January 2020

Summary

An input validation flaw in the web page generation process of FortiAuthenticator WEB UI version 6.0.0 allows unauthenticated attackers to inject malicious scripts via the logon page parameters. This vulnerability could be exploited to execute unauthorized scripts in the context of a user's session, potentially leading to the disclosure of sensitive information. Enhanced input validation measures are necessary to mitigate this vulnerability and ensure the integrity of user interactions with the web interface.

Affected Version(s)

FortiAuthenticator WEB UI 6.0.0

References

https://fortiguard.com/advisory/FG-IR-19-104
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.