CVE-2016-3978: XSS

Published Apr 8, 2016

Updated

The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."

Affected Software

17 affected components

Fortinet FortiOS=5.0.0

Fortinet FortiOS=5.0.1

Fortinet FortiOS=5.0.2

Fortinet FortiOS=5.0.3

Fortinet FortiOS=5.0.4

Fortinet FortiOS=5.0.5

Fortinet FortiOS=5.0.6

Fortinet FortiOS=5.0.7

Fortinet FortiOS=5.0.8

Fortinet FortiOS=5.0.9

Fortinet FortiOS=5.0.10

Fortinet FortiOS=5.0.11

Fortinet FortiOS=5.0.12

Fortinet FortiOS=5.2.0

Fortinet FortiOS=5.2.1

Fortinet FortiOS=5.2.2

Fortinet FortiOS=5.4

Event History

Apr 8, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3978?

CVE-2016-3978 has a medium severity rating, allowing attackers to conduct phishing or XSS attacks.

How do I fix CVE-2016-3978?

To fix CVE-2016-3978, you should upgrade to FortiOS versions 5.0.13, 5.2.3, or 5.4.0 and later.

What type of attacks can be executed through CVE-2016-3978?

CVE-2016-3978 allows for phishing attacks and cross-site scripting (XSS) through user redirection.

Which versions of FortiOS are affected by CVE-2016-3978?

CVE-2016-3978 affects FortiOS versions from 5.0.0 to 5.0.12, 5.2.0 to 5.2.2, and 5.4.x prior to 5.4.0.

How does CVE-2016-3978 exploit the WebUI in FortiOS?

CVE-2016-3978 exploits the WebUI by manipulating the "redirect" parameter during the login process to redirect users to malicious sites.