CVE-2016-3195: XSS

Published Aug 19, 2016

Updated

Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

36 affected components

Fortinet Fortimanager Firmware=5.0.0

Fortinet Fortimanager Firmware=5.0.1

Fortinet Fortimanager Firmware=5.0.2

Fortinet Fortimanager Firmware=5.0.3

Fortinet Fortimanager Firmware=5.0.4

Fortinet Fortimanager Firmware=5.0.5

Fortinet Fortimanager Firmware=5.0.6

Fortinet Fortimanager Firmware=5.0.7

Fortinet Fortimanager Firmware=5.0.8

Fortinet Fortimanager Firmware=5.0.9

Fortinet Fortimanager Firmware=5.0.10

Fortinet Fortimanager Firmware=5.0.11

Fortinet Fortimanager Firmware=5.2.0

Fortinet Fortimanager Firmware=5.2.1

Fortinet Fortimanager Firmware=5.2.2

Fortinet Fortimanager Firmware=5.2.3

Fortinet Fortimanager Firmware=5.2.4

Fortinet Fortimanager Firmware=5.2.5

Fortinet Fortianalyzer Firmware=5.0.0

Fortinet Fortianalyzer Firmware=5.0.2

Fortinet Fortianalyzer Firmware=5.0.3

Fortinet Fortianalyzer Firmware=5.0.4

Fortinet Fortianalyzer Firmware=5.0.5

Fortinet Fortianalyzer Firmware=5.0.6

Fortinet Fortianalyzer Firmware=5.0.7

Fortinet Fortianalyzer Firmware=5.0.8

Fortinet Fortianalyzer Firmware=5.0.9

Fortinet Fortianalyzer Firmware=5.0.10

Fortinet Fortianalyzer Firmware=5.0.11

Fortinet Fortianalyzer Firmware=5.0.12

Fortinet Fortianalyzer Firmware=5.2.0

Fortinet Fortianalyzer Firmware=5.2.1

Fortinet Fortianalyzer Firmware=5.2.2

Fortinet Fortianalyzer Firmware=5.2.3

Fortinet Fortianalyzer Firmware=5.2.4

Fortinet Fortianalyzer Firmware=5.2.5

Event History

Aug 19, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3195?

CVE-2016-3195 is categorized as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2016-3195?

To mitigate CVE-2016-3195, update Fortinet FortiManager and FortiAnalyzer firmware to versions 5.0.12, 5.2.6 or later.

Which versions are affected by CVE-2016-3195?

CVE-2016-3195 affects FortiManager versions 5.x before 5.0.12 and 5.2.x before 5.2.6, as well as FortiAnalyzer versions 5.x before 5.0.13 and 5.2.x before 5.2.6.

What are the potential impacts of CVE-2016-3195?

An attacker exploiting CVE-2016-3195 could inject arbitrary web scripts or HTML into the Web-UI of vulnerable FortiManager and FortiAnalyzer devices.

Is there a workaround for CVE-2016-3195?

While the recommended solution is to update the software, users can also limit access to the Web-UI to trusted networks as an interim workaround.