CVE-2017-14186

MEDIUM NUCLEI

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting

Title source: nuclei

Description

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.

Nuclei Templates (1)

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
MEDIUMVERIFIEDby johnk3r
Shodan: port:10443 http.favicon.hash:945408572 || http.favicon.hash:945408572 || cpe:"cpe:2.3:o:fortinet:fortios" || http.html:"/remote/login" "xxxxxxxx"
FOFA: body="/remote/login" "xxxxxxxx" || icon_hash=945408572

References (3)

Scores

CVSS v3 5.4
EPSS 0.0298
EPSS Percentile 86.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (5)
fortinet/fortios < 5.0
Fortinet, Inc./FortiOS 5.0 and below
Fortinet, Inc./FortiOS 5.2.0 to 5.2.12
Fortinet, Inc./FortiOS 5.4.0 to 5.4.6
Fortinet, Inc./FortiOS 5.6.0 to 5.6.2
Published Nov 29, 2017
Tracked Since Feb 18, 2026