CVE-2017-7732: XSS

Published Oct 26, 2017

Updated

A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.

Affected Software

36 affected components

Fortinet FortiMail=4.1.0

Fortinet FortiMail=4.2.0

Fortinet FortiMail=4.3.0

Fortinet FortiMail=4.3.8

Fortinet FortiMail=5.0

Fortinet FortiMail=5.0.1

Fortinet FortiMail=5.0.2

Fortinet FortiMail=5.0.3

Fortinet FortiMail=5.0.4

Fortinet FortiMail=5.0.5

Fortinet FortiMail=5.0.6

Fortinet FortiMail=5.0.7

Fortinet FortiMail=5.0.8

Fortinet FortiMail=5.0.9

Fortinet FortiMail=5.0.10

Fortinet FortiMail=5.1

Fortinet FortiMail=5.2

Fortinet FortiMail=5.2.1

Fortinet FortiMail=5.2.2

Fortinet FortiMail=5.2.3

Fortinet FortiMail=5.2.4

Fortinet FortiMail=5.2.5

Fortinet FortiMail=5.2.6

Fortinet FortiMail=5.2.7

Fortinet FortiMail=5.2.8

Fortinet FortiMail=5.2.9

Fortinet FortiMail=5.3

Fortinet FortiMail=5.3.1

Fortinet FortiMail=5.3.2

Fortinet FortiMail=5.3.3

Fortinet FortiMail=5.3.4

Fortinet FortiMail=5.3.5

Fortinet FortiMail=5.3.6

Fortinet FortiMail=5.3.7

Fortinet FortiMail=5.3.8

Fortinet FortiMail=5.3.9

Event History

Oct 26, 2017

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-7732?

CVE-2017-7732 is categorized as a medium severity reflected Cross-Site Scripting (XSS) vulnerability.

How does CVE-2017-7732 affect Fortinet FortiMail?

CVE-2017-7732 allows attackers to inject arbitrary web scripts or HTML into the pre-authentication webmail login page of affected FortiMail versions.

How do I fix CVE-2017-7732?

To mitigate CVE-2017-7732, Fortinet recommends upgrading to a patched version of FortiMail beyond the vulnerable releases.

Which versions of FortiMail are affected by CVE-2017-7732?

CVE-2017-7732 affects Fortinet FortiMail versions 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9.

What are the symptoms of exploitation of CVE-2017-7732?

Symptoms of exploitation of CVE-2017-7732 may include unexpected behavior on the webmail login page, such as the execution of malicious scripts.