Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via (1) the Add field for the Black List under Antispam Management User Preferences or (2) the User name field for the Personal Black/White List in the AntiSpam section.
References
Link | Resource |
---|---|
http://www.fortiguard.com/advisory/FG-IR-013-001.html | Vendor Advisory |
http://www.vulnerability-lab.com/get_content.php?id=701 | |
http://www.youtube.com/watch?v=5d7cIaM80oY | Exploit |
Configurations
Configuration 1 (hide)
AND |
|
History
No history.
Information
Published : 2013-02-04 19:55
Updated : 2024-02-04 18:16
NVD link : CVE-2013-1471
Mitre link : CVE-2013-1471
CVE.ORG link : CVE-2013-1471
JSON object : View
Products Affected
fortinet
- fortimail-5002b
- fortimail-200d
- fortimail-vm2000
- fortimail-2000b
- fortimail
- fortimail-400c
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')