Fortinet Fortiweb Multiple Security Vulnerabilities

Bugtraq ID:	74195
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 16 2015 12:00AM
Updated:	Apr 16 2015 12:00AM
Credit:	Fortinet
Vulnerable:	Fortinet FortiWeb 5.3.4 Fortinet FortiWeb 5.3.3 Fortinet FortiWeb 5.3.2 Fortinet FortiWeb 5.3.1 Fortinet FortiWeb 5.2.1 Fortinet FortiWeb 5.1 Fortinet FortiWeb 5.0.4 Fortinet FortiWeb 5.0.3 Fortinet FortiWeb 5.0.2 Fortinet FortiWeb 5.0.1 Fortinet FortiWeb 5.2.0 Fortinet FortiWeb 5.1.4 Fortinet FortiWeb 5.1.3 Fortinet FortiWeb 5.1.2 Fortinet FortiWeb 5.1.1 Fortinet FortiWeb 5.0.0
Not Vulnerable:	Fortinet FortiWeb 5.3.5

Fortinet Fortiweb Multiple Security Vulnerabilities

Fortinet Fortiweb is prone to an information-disclosure vulnerability , a command-injection vulnerability and a cross-site scripting vulnerability.

A remote attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, or execute arbitrary commands, or gain access to sensitive information in the context of the affected application.

Fortinet Fortiweb 5.0.0 through 5.3.4 are vulnerable.

Fortinet Fortiweb Multiple Security Vulnerabilities

Attackers can exploit these issues using browser or readily available tools. Attackers can exploit cross-site scripting issue by enticing an unsuspecting victim to follow a malicious URI.

Fortinet Fortiweb Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Fortinet Fortiweb Multiple Security Vulnerabilities

References:

• Fortinet Homepage (Fortinet)
  
• FortiWeb Homepage (Fortinet)
  
• FortiWeb multiple vulnerabilities (Fortinet)