CVE-2012-6346

MEDIUM

FortiWeb < 4.4.4 - Cross-Site Scripting via redir or mkey Parameter

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) redir or (2) mkey parameter to waf/pcre_expression/validate.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://www.vulnerability-lab.com/get_content.php?id=702

Vendor Advisory x_refsource_confirm

https://fortiguard.com/psirt/FG-IR-012-008

Scores

CVSS v3 6.1

EPSS 0.0026

EPSS Percentile 49.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

fortinet/fortiweb < 4.4.4

Published Feb 09, 2018

Tracked Since Feb 18, 2026