CVE-2017-7739: XSS
First published: Mon Nov 13 2017(Updated: )
A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FortiOS | =5.2.0 | |
| FortiOS | =5.2.1 | |
| FortiOS | =5.2.2 | |
| FortiOS | =5.2.3 | |
| FortiOS | =5.2.4 | |
| FortiOS | =5.2.5 | |
| FortiOS | =5.2.6 | |
| FortiOS | =5.2.7 | |
| FortiOS | =5.2.8 | |
| FortiOS | =5.2.9 | |
| FortiOS | =5.2.10 | |
| FortiOS | =5.2.11 | |
| FortiOS | =5.4.0 | |
| FortiOS | =5.4.1 | |
| FortiOS | =5.4.2 | |
| FortiOS | =5.4.3 | |
| FortiOS | =5.4.4 | |
| FortiOS | =5.4.5 | |
| FortiOS | =5.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-7739?
CVE-2017-7739 is classified as a reflected Cross-site Scripting (XSS) vulnerability.
How do I fix CVE-2017-7739?
To fix CVE-2017-7739, update Fortinet FortiOS to a version that addresses the vulnerability, preferably 5.6.1 or later.
What systems are affected by CVE-2017-7739?
CVE-2017-7739 affects Fortinet FortiOS versions 5.2.0 to 5.2.11, 5.4.0 to 5.4.5, and 5.6.0.
Can CVE-2017-7739 be exploited remotely?
Yes, CVE-2017-7739 can be exploited remotely by an unauthenticated attacker sending a specially crafted request.
What are the potential impacts of CVE-2017-7739?
Exploitation of CVE-2017-7739 could allow attackers to inject arbitrary web scripts or HTML into the victim's browser.
- agent/type
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortios
- version/fortios/5.2.0
- version/fortios/5.2.1
- version/fortios/5.2.2
- version/fortios/5.2.3
- version/fortios/5.2.4
- version/fortios/5.2.5
- version/fortios/5.2.6
- version/fortios/5.2.7
- version/fortios/5.2.8
- version/fortios/5.2.9
- version/fortios/5.2.10
- version/fortios/5.2.11
- version/fortios/5.4.0
- version/fortios/5.4.1
- version/fortios/5.4.2
- version/fortios/5.4.3
- version/fortios/5.4.4
- version/fortios/5.4.5
- version/fortios/5.6.0