CVE-2017-3125

MEDIUM

FortiMail 5.0.0-5.2.9 and 5.3.0-5.3.8 - Unauthenticated Cross-Site Scripting

Title source: llm

Description

An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

http://fortiguard.com/psirt/FG-IR-17-011

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/97474

Scores

CVSS v3 6.1

EPSS 0.0058

EPSS Percentile 69.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (32)

fortinet/fortimail 5.0

fortinet/fortimail 5.0.5

fortinet/fortimail 5.0.6

fortinet/fortimail 5.0.7

fortinet/fortimail 5.0.8

fortinet/fortimail 5.0.9

fortinet/fortimail 5.0.10

fortinet/fortimail 5.1

fortinet/fortimail 5.1.2

fortinet/fortimail 5.1.3

... and 22 more

Published Apr 12, 2017

Tracked Since Feb 18, 2026