Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter to csearch/report/export/; the (3) id parameter to analysis/detail/download/screenshot; or vectors related to (4) "Fortiview threats by users search filtered by vdom" or (5) "PCAP file download generated by the VM scan feature."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortisandbox | - |
| Fortinet | Fortisandbox Firmware | <= 2.0.4 |
Related Weaknesses (CWE)
References
- http://fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortisandbox-webuVendor Advisory
- http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt
- http://packetstormsecurity.com/files/132930/FortiSandbox-3000D-2.02-build0042-Cr
- http://www.securityfocus.com/archive/1/536124/100/0/threaded
- http://fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortisandbox-webuVendor Advisory
- http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt
- http://packetstormsecurity.com/files/132930/FortiSandbox-3000D-2.02-build0042-Cr
- http://www.securityfocus.com/archive/1/536124/100/0/threaded
FAQ
What is CVE-2015-7360?
CVE-2015-7360 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) seri...
How severe is CVE-2015-7360?
CVE-2015-7360 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7360?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortisandbox, Fortinet Fortisandbox Firmware.