github - ghsa-vpwv-v7qq-9vj6

ghsa-vpwv-v7qq-9vj6

Vulnerability from github

Published

2022-05-17 01:06

Modified

2022-05-17 01:06

Severity

5.4 (Medium) - CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2017-3131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-12T02:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in \"Applications\" under FortiView.",
  "id": "GHSA-vpwv-v7qq-9vj6",
  "modified": "2022-05-17T01:06:29Z",
  "published": "2022-05-17T01:06:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3131"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/advisory/FG-IR-17-104"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/42388"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100009"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039020"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2017-3131

Vulnerability from cvelistv5

Published

2017-09-12 02:00

Modified

2024-09-17 01:56

Severity

Summary

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.

References

URL	Tags
http://www.securityfocus.com/bid/100009	vdb-entry, x_refsource_BID
http://www.securitytracker.com/id/1039020	vdb-entry, x_refsource_SECTRACK
https://fortiguard.com/advisory/FG-IR-17-104	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/42388/	exploit, x_refsource_EXPLOIT-DB

Impacted products

Vendor	Product
Fortinet, Inc.	Fortinet FortiOS

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:16:28.221Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "100009",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100009"
          },
          {
            "name": "1039020",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039020"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://fortiguard.com/advisory/FG-IR-17-104"
          },
          {
            "name": "42388",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42388/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Fortinet FortiOS",
          "vendor": "Fortinet, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "FortiOS versions 5.4.0 through 5.4.4 and 5.6.0"
            }
          ]
        }
      ],
      "datePublic": "2017-09-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in \"Applications\" under FortiView."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-12T09:57:01",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "100009",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100009"
        },
        {
          "name": "1039020",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039020"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://fortiguard.com/advisory/FG-IR-17-104"
        },
        {
          "name": "42388",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/42388/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@fortinet.com",
          "DATE_PUBLIC": "2017-09-11T00:00:00",
          "ID": "CVE-2017-3131",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Fortinet FortiOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "FortiOS versions 5.4.0 through 5.4.4 and 5.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Fortinet, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in \"Applications\" under FortiView."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Execute unauthorized code or commands"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "100009",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100009"
            },
            {
              "name": "1039020",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039020"
            },
            {
              "name": "https://fortiguard.com/advisory/FG-IR-17-104",
              "refsource": "CONFIRM",
              "url": "https://fortiguard.com/advisory/FG-IR-17-104"
            },
            {
              "name": "42388",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/42388/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2017-3131",
    "datePublished": "2017-09-12T02:00:00Z",
    "dateReserved": "2016-12-02T00:00:00",
    "dateUpdated": "2024-09-17T01:56:12.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.