CVE-2018-1355

MEDIUM

FortiAnalyzer and FortiManager < 5.6.5 - Open Redirect via FortiView PDF Conversion

Title source: llm
STIX 2.1

Description

An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature. An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/104546
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041185
Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-18-022
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041184

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 45.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (4)
fortinet/fortianalyzer 6.0.0
fortinet/fortianalyzer < 5.6.5
fortinet/fortimanager 6.0.0
fortinet/fortimanager < 5.6.5
Published Jun 27, 2018
Tracked Since Feb 18, 2026