CVE-2017-17541

MEDIUM

FortiAnalyzer and FortiManager < 5.6.4 - Stored Cross-Site Scripting via CA and CRL Certificate Import

Title source: llm
STIX 2.1

Description

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-17-305
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041246
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041247

Scores

CVSS v3 6.1
EPSS 0.0017
EPSS Percentile 37.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
fortinet/fortianalyzer_firmware 6.0.0
fortinet/fortianalyzer_firmware < 5.6.4
fortinet/fortimanager_firmware 6.0.0
fortinet/fortimanager_firmware < 5.6.4
Published Jul 16, 2018
Tracked Since Feb 18, 2026