CVE-2016-3196
moderate-risk
Published 2016-08-05
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.
Do I need to act?
-
0.47% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10
Medium
NETWORK
/ LOW complexity
Affected Products (20)
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortianalyzer Firmware
Fortianalyzer Firmware
Fortianalyzer Firmware
Fortianalyzer Firmware
Fortianalyzer Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortimanager Firmware
Fortianalyzer Firmware
Affected Vendors
References (14)
Third Party Advisory
http://seclists.org/fulldisclosure/2016/Aug/4
Third Party Advisory
http://www.securityfocus.com/bid/92203
Third Party Advisory
http://www.securitytracker.com/id/1036551
Third Party Advisory
http://www.vulnerability-lab.com/get_content.php?id=1687
Third Party Advisory
http://seclists.org/fulldisclosure/2016/Aug/4
Third Party Advisory
http://www.securityfocus.com/bid/92203
Third Party Advisory
http://www.securitytracker.com/id/1036551
Third Party Advisory
http://www.vulnerability-lab.com/get_content.php?id=1687
44
/ 100
moderate-risk
Severity
21/34 · High
Exploitability
2/34 · Minimal
Exposure
21/34 · High