Lucene search

FortinetCVE-2020-12815

HistorySep 24, 2020 - 6:15 p.m.

CVE-2020-12815

2020-09-2418:15:16

CWE-79

fortinet

web.nvd.nist.gov

cve-2020-12815

improper input validation

fortitester

html injection

script injection

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields.

Affected configurations

Nvd

Node

fortinetfortianalyzerRange≤6.2.5

fortinetfortianalyzerRange6.4.0–6.4.1

fortinetfortitesterRange≤3.7.0

fortinetfortitesterMatch3.8.0

VendorProductVersionCPE
fortinetfortianalyzer*cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
fortinetfortitester*cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*
fortinetfortitester3.8.0cpe:2.3:a:fortinet:fortitester:3.8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortianalyzer	*	cpe:2.3:a:fortinet:fortianalyzer::::::::
fortinet	fortitester	*	cpe:2.3:a:fortinet:fortitester::::::::
fortinet	fortitester	3.8.0	cpe:2.3:a:fortinet:fortitester:3.8.0:::::::*

CNA Affected

[
  {
    "product": "Fortinet FortiTester",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiTester before 3.9.0"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-20-054

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2020-12815