Fortinet FortiOS CVE-2017-3128 HTML Injection Vulnerability

Bugtraq ID:	98514
Class:	Input Validation Error
CVE:	CVE-2017-3128
Remote:	Yes
Local:	No
Published:	May 17 2017 12:00AM
Updated:	May 17 2017 12:00AM
Credit:	Mohamed Keffous from CAP GEMINI/SOGETI
Vulnerable:	Fortinet Fortios 5.2.8 Fortinet Fortios 5.2.6 Fortinet Fortios 5.2.5 Fortinet Fortios 5.2.4 Fortinet Fortios 5.2.3 Fortinet Fortios 5.2.2 Fortinet Fortios 5.2.1 Fortinet Fortios 5.2.9 Fortinet Fortios 5.2.10 Fortinet Fortios 5.2.0 Fortinet FortiOS 5.0
Not Vulnerable:	Fortinet Fortios 5.2.11 Fortinet Fortios 5.4.0

Fortinet FortiOS CVE-2017-3128 HTML Injection Vulnerability

FortiOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

Fortinet FortiOS CVE-2017-3128 HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

Fortinet FortiOS CVE-2017-3128 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.