CVE-2017-7739
Summary
| CVE | CVE-2017-7739 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-11-13 14:29:00 UTC |
| Updated | 2017-11-29 15:18:00 UTC |
| Description | A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fortinet | Fortios | 5.2.0 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.1 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.10 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.11 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.2 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.3 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.4 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.5 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.6 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.7 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.8 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.9 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.0 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.1 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.2 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.3 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.4 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.5 | All | All | All |
| Operating System | Fortinet | Fortios | 5.6.0 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.0 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.1 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.10 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.11 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.2 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.3 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.4 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.5 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.6 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.7 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.8 | All | All | All |
| Operating System | Fortinet | Fortios | 5.2.9 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.0 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.1 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.2 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.3 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.4 | All | All | All |
| Operating System | Fortinet | Fortios | 5.4.5 | All | All | All |
| Operating System | Fortinet | Fortios | 5.6.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| FortiOS Reflected XSS in Web Proxy Disclaimer Response web page | FortiGuard | CONFIRM | fortiguard.com | Issue Tracking, Vendor Advisory |
| Fortinet FortiOS Input Validation Flaw in Web Proxy Disclaimer Response Lets Remote Users Conduct Cross-Site Scripting Attacks - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Fortinet FortiOS CVE-2017-7739 Cross Site Scripting Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.