CVE-2018-13375: XSS
An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager (with FortiAnalyzer feature enabled).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2018-13375.
What is the severity of CVE-2018-13375?
The severity of CVE-2018-13375 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2018-13375?
Fortinet FortiAnalyzer versions 5.6.0 and below, as well as Fortinet FortiManager versions 5.6.0 and below, are affected.
How does CVE-2018-13375 work?
An attacker can send a DHCP request with malicious scripts in the HOSTNAME parameter, which are executed when viewing logs in FortiAnalyzer.
Is there a fix available for CVE-2018-13375?
Yes, Fortinet has released patches to address the vulnerability. It is recommended to update to the latest version of FortiAnalyzer and FortiManager.