VulnerabilityModified

CVE-2015-3620

Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject…

MEDIUM 4.3EPSS 2.37%

Does this matter?

Lower severity and a low EPSS score (2.37%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.37% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: fortinet/fortimanager firmware · fortinet/fortianalyzer firmware
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/May/13Exploit, Third Party Advisory, VDB Entry
http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/archive/1/535452/100/0/threaded
http://www.securityfocus.com/bid/74646Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/May/13Exploit, Third Party Advisory, VDB Entry
http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/archive/1/535452/100/0/threaded
http://www.securityfocus.com/bid/74646Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.