FKIE_CVE-2015-7363

Vulnerability from fkie_nvd - Published: 2016-10-07 14:59 - Updated: 2025-04-12 10:46
Severity ?
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
References
cve@mitre.orghttp://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filtersVendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/93413
cve@mitre.orghttp://www.securitytracker.com/id/1036981
cve@mitre.orghttp://www.securitytracker.com/id/1036982
af854a3a-2127-422b-91ae-364da2661108http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filtersVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/93413
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036981
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036982
Impacted products
Vendor Product Version
fortinet fortimanager_firmware 5.0.0
fortinet fortimanager_firmware 5.0.1
fortinet fortimanager_firmware 5.0.2
fortinet fortimanager_firmware 5.0.3
fortinet fortimanager_firmware 5.0.4
fortinet fortimanager_firmware 5.0.5
fortinet fortimanager_firmware 5.0.6
fortinet fortimanager_firmware 5.0.7
fortinet fortimanager_firmware 5.0.8
fortinet fortimanager_firmware 5.0.9
fortinet fortimanager_firmware 5.0.10
fortinet fortimanager_firmware 5.0.11
fortinet fortimanager_firmware 5.2.0
fortinet fortimanager_firmware 5.2.1
fortinet fortimanager -
fortinet fortianalyzer_firmware 5.0.0
fortinet fortianalyzer_firmware 5.0.1
fortinet fortianalyzer_firmware 5.0.2
fortinet fortianalyzer_firmware 5.0.3
fortinet fortianalyzer_firmware 5.0.4
fortinet fortianalyzer_firmware 5.0.5
fortinet fortianalyzer_firmware 5.0.6
fortinet fortianalyzer_firmware 5.0.7
fortinet fortianalyzer_firmware 5.0.8
fortinet fortianalyzer_firmware 5.0.9
fortinet fortianalyzer_firmware 5.0.10
fortinet fortianalyzer_firmware 5.0.11
fortinet fortianalyzer_firmware 5.0.12
fortinet fortianalyzer_firmware 5.2.0
fortinet fortianalyzer_firmware 5.2.1
fortinet fortianalyzer_firmware 5.2.2
fortinet fortianalyzer -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "833C89CE-43F0-4F6E-8A4F-504EA5F16319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C96F78B0-2F6E-4A28-B0B8-CCE3638DCCDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "68D3536B-652C-4642-9FF9-5A7CFDBB7DD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D9B23B1-A527-49B6-A6CB-CFFCF278B70E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortimanager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A46415B-E9D2-463D-AE16-D51DEEC23690",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EBA54E4-E824-4F68-94BF-D70F5A51B40F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "378DE593-6514-4111-95DF-C881E163E6D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEAD4CF6-6654-4BCC-8EC4-5B11AF81C123",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FEC6473-536E-4ADB-9BD1-8A75846A039E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "799DA4F4-F5DD-4D56-ACC0-C28891C27A57",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AD6F2AF-F98F-4113-94D8-1F3D26702D82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "647BBA50-058A-4D8D-884A-83A818B90622",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "042001D0-4E10-488F-AB01-AFEB23D78C01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "728F1AAE-6156-443B-A5DA-990538432389",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortianalyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "156CCFE2-8ED2-417E-8A32-C3AB1DD97C8B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en la p\u00e1gina de configuraci\u00f3n avanzada en Fortinet FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.3, en los modelos de hardware con un disco duro y FortiAnalyzer 5.x en versiones anteriores a 5.0.13 y 5.2.x en versiones anteriores a 5.2.3 permite a administradores remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores relacionados con filtros de informe."
    }
  ],
  "id": "CVE-2015-7363",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-10-07T14:59:02.677",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/93413"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1036981"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1036982"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/93413"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1036981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1036982"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.