CVE-2018-13375: XSS
First published: Tue May 28 2019(Updated: )
An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager (with FortiAnalyzer feature enabled).
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | <=5.6.0 | |
| Fortinet FortiManager | <=5.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2018-13375.
What is the severity of CVE-2018-13375?
The severity of CVE-2018-13375 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2018-13375?
Fortinet FortiAnalyzer versions 5.6.0 and below, as well as Fortinet FortiManager versions 5.6.0 and below, are affected.
How does CVE-2018-13375 work?
An attacker can send a DHCP request with malicious scripts in the HOSTNAME parameter, which are executed when viewing logs in FortiAnalyzer.
Is there a fix available for CVE-2018-13375?
Yes, Fortinet has released patches to address the vulnerability. It is recommended to update to the latest version of FortiAnalyzer and FortiManager.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/fortinet
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/5.6.0
- canonical/fortinet fortimanager
- version/fortinet fortimanager/5.6.0