{"api_version":"1","generated_at":"2026-07-23T09:30:55+00:00","cve":"CVE-2014-8616","urls":{"html":"https://cve.report/CVE-2014-8616","api":"https://cve.report/api/cve/CVE-2014-8616.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8616","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8616"},"summary":{"title":"CVE-2014-8616","description":"Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-05-12 19:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1032262","name":"http://www.securitytracker.com/id/1032262","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fortinet FortiManager Input Validation Flaws in SSLVPN Login Page, User Group Menu, VPN Template Menu, and Advanced Dataset Reports Page Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032265","name":"http://www.securitytracker.com/id/1032265","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fortinet FortiADC Input Validation Flaws in SSLVPN Login Page, User Group Menu, VPN Template Menu, and Theme Login Page Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032264","name":"http://www.securitytracker.com/id/1032264","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fortinet FortiMail Input Validation Flaws in SSLVPN Login Page, User Group Menu, and VPN Template Menu Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032261","name":"http://www.securitytracker.com/id/1032261","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fortinet FortiGate Input Validation Flaws in SSLVPN Login Page, User Group Menu, and VPN Template Menu Permit Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.fortiguard.com/advisory/FG-IR-15-005/","name":"http://www.fortiguard.com/advisory/FG-IR-15-005/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"FortiGuard.com | Multiple products cross-site scripting vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8616","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8616","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8616","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortios","cpe6":"5.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8616","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortios","cpe6":"5.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8616","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fortinet","cpe5":"fortios","cpe6":"5.2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:26:01.097Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1032261","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032261"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.fortiguard.com/advisory/FG-IR-15-005/"},{"name":"1032265","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032265"},{"name":"1032264","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032264"},{"name":"1032262","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032262"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-02-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1032261","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032261"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.fortiguard.com/advisory/FG-IR-15-005/"},{"name":"1032265","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032265"},{"name":"1032264","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032264"},{"name":"1032262","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032262"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-8616","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1032261","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032261"},{"name":"http://www.fortiguard.com/advisory/FG-IR-15-005/","refsource":"CONFIRM","url":"http://www.fortiguard.com/advisory/FG-IR-15-005/"},{"name":"1032265","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032265"},{"name":"1032264","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032264"},{"name":"1032262","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032262"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-8616","datePublished":"2015-05-12T19:00:00.000Z","dateReserved":"2014-11-04T00:00:00.000Z","dateUpdated":"2024-08-06T13:26:01.097Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-05-12 19:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*","matchCriteriaId":"7E627C59-7C16-44F0-800D-A2E8A766B26D"},{"vulnerable":true,"criteria":"cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*","matchCriteriaId":"233236FA-BB13-4261-BE2E-3E617406DC53"},{"vulnerable":true,"criteria":"cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*","matchCriteriaId":"27844CC9-498B-4A65-91AC-AC130222EE5F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8616","Ordinal":"1","Title":"CVE-2014-8616","CVE":"CVE-2014-8616","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8616","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) user group or (2) vpn template menus.","Type":"Description","Title":"CVE-2014-8616"},{"CveYear":"2014","CveId":"8616","Ordinal":"2","NoteData":"2015-05-12","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8616","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}