The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/108786 | Third Party Advisory VDB Entry |
https://fortiguard.com/advisory/FG-IR-19-070 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: fortinet
Published: 2019-08-28T16:45:15
Updated: 2019-08-28T16:45:20
Reserved: 2019-01-07T00:00:00
Link: CVE-2019-5590
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-08-28T17:15:09.917
Modified: 2019-09-03T17:36:09.097
Link: CVE-2019-5590
JSON object: View
Redhat Information
No data.
CWE