CVE-2019-5590

2019-08-2816:45:15

fortinet

www.cve.org

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

38.2%

JSON

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.

CNA Affected

[
  {
    "product": "FortiWeb",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.2 and below"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108786

fortiguard.com/advisory/FG-IR-19-070