FortiWeb 4.x / 5.x < 5.0.3 Multiple Vulnerabilities

2015-04-0900:00:00

Tenable

www.tenable.com

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.002

Percentile

61.3%

The remote host is running FortiWeb 4.x / 5.x prior to 5.0.3. It is, therefore, affected by multiple vulnerabilities :

FortiWeb is affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input. (CVE-2014-1955)
FortiWeb is affected by an unspecified HTTP header injection vulnerability. (CVE-2014-1956)
FortiWeb is affected by an unspecified privilege escalation vulnerability. (CVE-2014-1957)