CVE-2015-7363

MEDIUM

FortiManager and FortiAnalyzer 5.x < 5.0.12, 5.2.x < 5.2.3 - Stored Cross-Site Scripting in Report Filters

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036981
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036982
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93413

Scores

CVSS v3 5.4
EPSS 0.0033
EPSS Percentile 55.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (30)
fortinet/fortianalyzer_firmware 5.0.0
fortinet/fortianalyzer_firmware 5.0.1
fortinet/fortianalyzer_firmware 5.0.2
fortinet/fortianalyzer_firmware 5.0.3
fortinet/fortianalyzer_firmware 5.0.4
fortinet/fortianalyzer_firmware 5.0.5
fortinet/fortianalyzer_firmware 5.0.6
fortinet/fortianalyzer_firmware 5.0.7
fortinet/fortianalyzer_firmware 5.0.8
fortinet/fortianalyzer_firmware 5.0.9
... and 20 more
Published Oct 07, 2016
Tracked Since Feb 18, 2026