CVE-2012-0941

MEDIUM

FortiOS 4.3.0-4.3.5 - Cross-Site Scripting via Multiple Parameters

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Endpoint Monitor, (2) Dialup List, or (3) Log&Report Display modules, or the fields_sorted_opt parameter to (4) user/auth/list or (5) endpointcompliance/app_detect/predefined_sig_list.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
https://securitytracker.com/id/1026594
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.org/files/109168/VL-144.txt
Exploit, Third Party Advisory x_refsource_misc
https://www.vulnerability-lab.com/get_content.php?id=144
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51708
Vendor Advisory x_refsource_confirm
https://fortiguard.com/psirt/FG-IR-012-001

Scores

CVSS v3 6.1
EPSS 0.0086
EPSS Percentile 75.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
fortinet/fortios 4.3.0 - 4.3.6
Published Feb 08, 2018
Tracked Since Feb 18, 2026