cve-2015-3620
Vulnerability from cvelistv5
Published
2015-05-12 19:00
Modified
2024-08-06 05:47
Severity
Summary
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
SourceURLTags
cve@mitre.orghttp://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
cve@mitre.orghttp://seclists.org/fulldisclosure/2015/May/13Exploit, Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/535452/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/74646Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry
Impacted products
VendorProduct
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:47:57.762Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
          },
          {
            "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
          },
          {
            "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
          },
          {
            "name": "74646",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74646"
          },
          {
            "name": "1032262",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032262"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
        },
        {
          "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
        },
        {
          "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
        },
        {
          "name": "74646",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74646"
        },
        {
          "name": "1032262",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032262"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-3620",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.fortiguard.com/advisory/FG-IR-15-005/",
              "refsource": "CONFIRM",
              "url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
            },
            {
              "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/13"
            },
            {
              "name": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
            },
            {
              "name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
            },
            {
              "name": "74646",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74646"
            },
            {
              "name": "1032262",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032262"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-3620",
    "datePublished": "2015-05-12T19:00:00",
    "dateReserved": "2015-04-30T00:00:00",
    "dateUpdated": "2024-08-06T05:47:57.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2015-3620\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-05-12T19:59:23.043\",\"lastModified\":\"2018-10-09T19:56:55.827\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en la p\u00e1gina de los informes de dataset avanzados en Fortinet FortiAnalyzer 5.0.0 hasta 5.0.10 y 5.2.0 hasta 5.2.1 y FortiManager 5.0.3 hasta 5.0.10 y 5.2.0 hasta 5.2.1 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5DF6CBD-E8D8-40B7-9512-CD739D6FA918\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34B83D3F-23C8-4781-887C-1876B103A4B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AB152570-F07F-4706-9717-D31F5F31CDE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2A3410C-E673-49C1-AA2C-2BD77C68DCA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AFEA22C-D661-4859-86CE-329D23E3EF87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72523D47-A6FA-48E8-B2D0-3563027CE35C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE6366D-0535-4681-90F7-3AB9386184A2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B83E355-BA1A-47B3-AE43-04668C87FD8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EBA54E4-E824-4F68-94BF-D70F5A51B40F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B27A485B-71F5-485C-9F3C-691A4F1CA5A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E098F02-C9DA-4EC9-B13C-8DFD6735615F\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2015/May/13\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.fortiguard.com/advisory/FG-IR-15-005/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/535452/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/74646\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1032262\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.