CVE-2017-14186: XSS
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14186?
CVE-2017-14186 is considered a medium severity vulnerability due to its potential impact on user data and privacy.
How do I fix CVE-2017-14186?
To fix CVE-2017-14186, upgrade your Fortinet FortiOS to a version that is not vulnerable, specifically versions 6.0.5 or later.
What kind of attacks can result from CVE-2017-14186?
CVE-2017-14186 may allow attackers to perform cross-site scripting (XSS) attacks against users by injecting arbitrary scripts.
Which versions of FortiOS are affected by CVE-2017-14186?
CVE-2017-14186 affects Fortinet FortiOS versions 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and all versions below 5.4.
Can CVE-2017-14186 be exploited remotely?
Yes, CVE-2017-14186 can be exploited remotely by a user with access to the SSL VPN web portal.