{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-07-14T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "92203", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92203"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2016/Aug/4"}, {"name": "1036550", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1036550"}, {"tags": ["x_refsource_MISC"], "url": "http://www.vulnerability-lab.com/get_content.php?id=1687"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"}, {"name": "1036551", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1036551"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-3196", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "92203", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92203"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2016/Aug/4"}, {"name": "1036550", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036550"}, {"name": "http://www.vulnerability-lab.com/get_content.php?id=1687", "refsource": "MISC", "url": "http://www.vulnerability-lab.com/get_content.php?id=1687"}, {"name": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability", "refsource": "CONFIRM", "url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"}, {"name": "1036551", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036551"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:47:58.322Z"}, "title": "CVE Program Container", "references": [{"name": "92203", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92203"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2016/Aug/4"}, {"name": "1036550", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1036550"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.vulnerability-lab.com/get_content.php?id=1687"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"}, {"name": "20160801 Fortinet FortiManager & FortiAnalyzer - (filename) Persistent Web Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"}, {"name": "1036551", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1036551"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-3196", "datePublished": "2016-08-05T14:00:00", "dateReserved": "2016-03-15T00:00:00", "dateUpdated": "2024-08-05T23:47:58.322Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "0F5BBE82-1D71-40EE-B506-1DD1066F537C", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "F1A2A3F2-A908-4192-8032-F8FA3310B50A", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "0B621447-97C3-42B4-92FF-3D5BEDE26A2F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "4D281C46-3C6A-4ABA-B25C-1FA623F78566", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "4EBA54E4-E824-4F68-94BF-D70F5A51B40F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "D43C2347-D6F3-40A6-8E00-DD31F11A84BB", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "A48CA4D3-FBD6-4048-8FFB-C0A874402E1E", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "4F9636D8-7C3B-4504-9D1C-01AC471EAFAF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."}, {"lang": "es", "value": "Vulnerabilidad de XSS en Fortinet FortiAnalyzer 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 y FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del nombre de archivo de una imagen cargada en la secci\u00f3n del informe."}], "id": "CVE-2016-3196", "lastModified": "2018-10-09T19:59:48.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-08-05T14:59:06.547", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://seclists.org/fulldisclosure/2016/Aug/4"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/92203"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1036550"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1036551"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.vulnerability-lab.com/get_content.php?id=1687"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}