CVE-2015-7360
MEDIUMFortinet Fortisandbox Firmware < 2.0.4 - XSS
Title source: ruleDescription
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
References (4)
Scores
CVSS v3
6.1
EPSS
0.0026
EPSS Percentile
48.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-79
Status
draft
Affected Products (1)
fortinet/fortisandbox_firmware
< 2.0.4
Timeline
Published
May 26, 2016
Tracked Since
Feb 18, 2026