The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:51
Type | Values Removed | Values Added |
---|---|---|
References | () http://seclists.org/fulldisclosure/2016/Mar/68 - | |
References | () http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability - Vendor Advisory | |
References | () http://www.securitytracker.com/id/1035332 - |
Information
Published : 2016-04-08 14:59
Updated : 2024-11-21 02:51
NVD link : CVE-2016-3978
Mitre link : CVE-2016-3978
CVE.ORG link : CVE-2016-3978
JSON object : View
Products Affected
fortinet
- fortios
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')