VulnerabilityModified

CVE-2016-3196

Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the…

MEDIUM 5.4EPSS 0.99%

Does this matter?

Lower severity and a low EPSS score (0.99%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.99% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: fortinet/fortimanager firmware · fortinet/fortianalyzer firmware
Source: cve@mitre.org

References

http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerabilityVendor Advisory
http://seclists.org/fulldisclosure/2016/Aug/4Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539069/100/0/threaded
http://www.securityfocus.com/bid/92203Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036550
http://www.securitytracker.com/id/1036551Third Party Advisory, VDB Entry
http://www.vulnerability-lab.com/get_content.php?id=1687Third Party Advisory, VDB Entry
http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerabilityVendor Advisory
http://seclists.org/fulldisclosure/2016/Aug/4Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539069/100/0/threaded
http://www.securityfocus.com/bid/92203Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036550
http://www.securitytracker.com/id/1036551Third Party Advisory, VDB Entry
http://www.vulnerability-lab.com/get_content.php?id=1687Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.