{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \"redirect\" parameter to \"login.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-04-08T14:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20160320 FortiOS (Fortinet) - Open Redirect and Cross Site Scripting", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2016/Mar/68"}, {"name": "1035332", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1035332"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-3978", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \"redirect\" parameter to \"login.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20160320 FortiOS (Fortinet) - Open Redirect and Cross Site Scripting", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2016/Mar/68"}, {"name": "1035332", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1035332"}, {"name": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability", "refsource": "CONFIRM", "url": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:10:31.955Z"}, "title": "CVE Program Container", "references": [{"name": "20160320 FortiOS (Fortinet) - Open Redirect and Cross Site Scripting", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2016/Mar/68"}, {"name": "1035332", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1035332"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-3978", "datePublished": "2016-04-08T14:00:00Z", "dateReserved": "2016-04-08T00:00:00Z", "dateUpdated": "2024-09-16T19:46:15.797Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "1E542BE2-14FC-4BA8-890C-7DA81F33F032", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "0D8A5EC4-CE2C-4174-9F09-361B8D153AD9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "C3BABC91-F9BF-4B52-BDBF-F9617ABCAC9F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "9C172379-F6BA-4343-831A-62004E742C6D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "516597D9-086E-4668-A40B-473F38125F92", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "D62F480B-D8CA-4F5C-8034-C0AE73F26B67", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "F435F408-EC5B-42A0-9E3C-4DE5D702ACAE", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "823C8357-E638-4EAE-B231-3B60263FFE52", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "1C6615C7-C6F8-4E42-BA09-5A29A0B68E09", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "B24C5917-BBC0-4924-9FB0-49E141DC9D54", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "513A1CAA-9B87-4CF5-9513-396E2E686CDF", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "62CD94B3-C430-4672-BBEA-B8A542944F66", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "91AA2061-5D28-4DCF-9126-8D5CE57D96F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "7E627C59-7C16-44F0-800D-A2E8A766B26D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "233236FA-BB13-4261-BE2E-3E617406DC53", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "27844CC9-498B-4A65-91AC-AC130222EE5F", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.4:*:*:*:*:*:*:*", "matchCriteriaId": "0E953F20-9598-4074-BC65-2FEA3ED2ECF1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \"redirect\" parameter to \"login.\""}, {"lang": "es", "value": "La Web User Interface (WebUI) en FortiOS 5.0.x en versiones anteriores a 5.0.13, 5.2.x en versiones anteriores a 5.2.3 y 5.4.x en versiones anteriores a 5.4.0 permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing o ataques de XSS a trav\u00e9s del par\u00e1metro \"redirect\" en \"login\"."}], "id": "CVE-2016-3978", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-04-08T14:59:07.913", "references": [{"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2016/Mar/68"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1035332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2016/Mar/68"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1035332"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}